From f501babb88aafe50dc47a0eee850c78d2a63d023 Mon Sep 17 00:00:00 2001
From: quobix <dave@quobix.com>
Date: Fri, 22 May 2026 09:47:30 -0700
Subject: [PATCH] use trusted publishing

---
 .github/workflows/publish.yaml | 31 ++++++++++---------------------
 1 file changed, 10 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 9db6e89..72d61b8 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -37,41 +37,30 @@ jobs:
   publish_npm:
     name: Publish to NPM
     needs: release_and_brew
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    # npm trusted publishing currently requires a GitHub-hosted runner.
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Set version
-        id: vars
-        run: echo ::set-output name=tag::${GITHUB_REF#refs/*/}
+        uses: actions/checkout@v6
 
       - name: Check version
         run: echo "Version ${{ github.event.client_payload.new-tag }}"
 
-      - name: Use Node.js 20
-        uses: actions/setup-node@v3
+      - name: Use Node.js 24
+        uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24
           registry-url: https://registry.npmjs.org/
 
-      - name: Setup Git user
-        run: |
-          git config --global user.name "pb33f github bot"
-          git config --global user.email "github-bot@pb33f.io"
-      - name: Create .npmrc file
-        run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-
       - name: Bump NPM version
         run: npm --no-git-tag-version --allow-same-version version ${{ github.event.client_payload.new-tag }}
 
       - name: NPM publish
-        run: npm publish --access public
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --access public --provenance
 
   push_to_registries:
     name: Push Docker image to multiple registries