chore(npm): Update release npm action to stop using tokens

[gnbm]

What is the current behavior?

• The CD workflow still relies on a long-lived NPM_TOKEN, so it cannot use npm’s trusted-publisher (OIDC) flow.
• CI runs against Node 18 and uses unpinned action versions.

GitHub Issue Number: N/A

What is the new behavior?

• CD workflow now requests id-token: write, configures actions/setup-node@v6 with the npm registry, upgrades npm, and runs npm run publish:ci without writing .npmrc, so publishing uses the short-lived OIDC credential.
  • Allows npm to authenticate through trusted publishing requirements docs.npmjs.com/trusted-publishers.
• CI workflow tests on Node 20.x and pins actions/checkout and actions/setup-node to the most recent versions.

Does this introduce a breaking change?

• Yes
• No

Testing

• Not run (GitHub Actions workflow update only).

Other information

• Aligns all release workflows with npm’s trusted-publishing requirements so the branch can pass new registry enforcement.

[Copilot]

Pull Request Overview

This PR modernizes the CI/CD workflows by updating Node.js versions, pinning GitHub Actions to specific commit SHAs for security, and transitioning to a more secure npm authentication method using OIDC.

Key changes:

• Upgraded Node.js from version 18 to version 20 across both workflows
• Pinned GitHub Actions to commit SHAs with version tags for immutability and security
• Refactored npm authentication from .npmrc token approach to registry-url configuration with OIDC permissions

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/ci.yml	Updated Node version to 20.x, pinned actions to commit SHAs, and added emoji labels to workflow steps
.github/workflows/cd.yml	Updated Node version to 20, added OIDC permissions block, replaced manual npm token setup with registry-url configuration, and added emoji labels to workflow steps

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.