ci: use trusted publisher for npm publish

haoqunjiang · haoqunjiang · commit d1142c453f27 · 2025-08-15T16:35:09.000+08:00
No longer needs the `NPM_TOKEN` secret.

But the "Publish" environment is kept for deployment protection.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -19,6 +19,7 @@ jobs:
         with:
           node-version: 'lts/*'
           registry-url: 'https://registry.npmjs.org'
+      # Ensure npm 11.5.1 or later is installed
+      - name: Update npm
+        run: npm install -g npm@latest
       - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
