From 5e8c83ca0c67d6420e09872cee0525068172735e Mon Sep 17 00:00:00 2001
From: Gavyn McKenzie <gavyn@etch.co>
Date: Thu, 25 Jun 2026 05:24:10 +0100
Subject: [PATCH 1/3] ci: publish to npm via OIDC trusted publishing

Replaces the NPM_TOKEN-based publish (which broke in #44 when the token
became invalid) with npm OIDC trusted publishing, matching the etchteam/eslint
setup.

- Drop NPM_TOKEN; add id-token: write permission for OIDC
- Bump semantic-release 19.x -> 25.0.1 for @semantic-release/npm >= 13.1.0
- Add setup-node + registry-url; pin action SHAs
- Bump .nvmrc 22 -> 24 for npm >= 11.5.1 (required by OIDC)

Closes #44
---
 .github/workflows/publish.yml | 36 ++++++++++++++++++++++-------------
 .nvmrc                        |  2 +-
 2 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b316cc5..bdd1126 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,33 +1,43 @@
-name: 🚀 Publish
+---
+name: 🚀 Release
+
 on:
   push:
     branches:
-    - main
+      - main
 
 env:
   HUSKY: 0
 
+permissions:
+  contents: read
+
 jobs:
   publish:
-    name: Publish
+    name: 🚀 Publish
     runs-on: ubuntu-latest
-    if: "! contains(toJSON(github.event.commits.*.message), '[skip ci]')"
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      id-token: write
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           fetch-depth: 0
           persist-credentials: false
-      - name: Publish
-        uses: cycjimmy/semantic-release-action@v3
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
+        with:
+          node-version-file: .nvmrc
+          registry-url: https://registry.npmjs.org
+      - uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90
         with:
-          semantic_version: 19.x
+          semantic_version: 25.0.1
           branch: main
           extends: |
             @semantic-release/git@10.0.1
-            @semantic-release/changelog@6.0.2
-            @commitlint/cli@17.3.0
-            @commitlint/config-conventional@17.3.0
+            @semantic-release/changelog@6.0.3
+            @commitlint/cli@20.3.1
+            @commitlint/config-conventional@20.3.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.nvmrc b/.nvmrc
index 2bd5a0a..a45fd52 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-22
+24

From ff1248edcf7343e3644192243a99e00417427976 Mon Sep 17 00:00:00 2001
From: Gavyn McKenzie <gavyn@etch.co>
Date: Thu, 25 Jun 2026 12:38:56 +0100
Subject: [PATCH 2/3] refactor: no content permissions

Co-authored-by: Josh Rose <1677846+JoshTheWanderer@users.noreply.github.com>
---
 .github/workflows/publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index bdd1126..08d1dbe 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -10,7 +10,7 @@ env:
   HUSKY: 0
 
 permissions:
-  contents: read
+  contents: none
 
 jobs:
   publish:

From acf79e1127ea314933c91b238832c7d8b217f244 Mon Sep 17 00:00:00 2001
From: Gavyn McKenzie <gavyn@etch.co>
Date: Thu, 25 Jun 2026 12:39:10 +0100
Subject: [PATCH 3/3] refactor: only read permissions

Co-authored-by: Josh Rose <1677846+JoshTheWanderer@users.noreply.github.com>
---
 .github/workflows/publish.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 08d1dbe..f8597fb 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,6 +15,8 @@ permissions:
 jobs:
   publish:
     name: 🚀 Publish
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     permissions:
       contents: write