ci: publish to npm via OIDC trusted publishing

.github/workflows/publish.yml

@@ -1,33 +1,45 @@
-name: 🚀 Publish
+---
+name: 🚀 Release
+
 on:
   push:
     branches:
-    - main
+      - main
 
 env:
   HUSKY: 0
 
+permissions:
+  contents: none
+
 jobs:
   publish:
-    name: Publish
+    name: 🚀 Publish
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
-    if: "! contains(toJSON(github.event.commits.*.message), '[skip ci]')"
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      id-token: write
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           fetch-depth: 0
           persist-credentials: false
-      - name: Publish
-        uses: cycjimmy/semantic-release-action@v3
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
+        with:
+          node-version-file: .nvmrc
+          registry-url: https://registry.npmjs.org
+      - uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90
         with:
-          semantic_version: 19.x
+          semantic_version: 25.0.1
           branch: main
           extends: |
             @semantic-release/git@10.0.1
-            @semantic-release/changelog@6.0.2
-            @commitlint/cli@17.3.0
-            @commitlint/config-conventional@17.3.0
+            @semantic-release/changelog@6.0.3
+            @commitlint/cli@20.3.1
+            @commitlint/config-conventional@20.3.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.nvmrc

@@ -1 +1 @@
-22
+24