From 1ad066a6f2273cab341b233bd42720a2d6417689 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 24 Jul 2026 13:01:14 +0000
Subject: [PATCH 1/2] Initial plan


From 212adef6045d93a0da72a64de1161f36e303fcae Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 24 Jul 2026 13:03:22 +0000
Subject: [PATCH 2/2] ci: add support for NPM OIDC trusted publishing in
 release workflow

---
 .github/workflows/release.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dbb1867..9afd239 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,7 @@ jobs:
       contents: write # for release publishing
       pull-requests: write # for creating PRs
       issues: write # additional permission that might be needed
+      id-token: write # for NPM OIDC trusted publishing
 
     name: Release
     env:
@@ -30,12 +31,13 @@ jobs:
           cache: 'yarn'
       - name: Install dependencies
         run: yarn install --frozen-lockfile --non-interactive
+      - name: Update npm for OIDC trusted publishing
+        run: npm install -g npm@latest
       - run: yarn build
       - name: Release
         id: semantic_release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npx semantic-release
       - name: Create PR with release changes
         if: ${{ success() && steps.semantic_release.outcome == 'success' }}