From 62cde014a9f39a98b521c2d582375da17022ad95 Mon Sep 17 00:00:00 2001
From: Rod Vagg <rod@vagg.org>
Date: Mon, 19 Jan 2026 15:56:20 +1100
Subject: [PATCH] chore: switch to npm OIDC publishing

---
 .github/workflows/test-and-release.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test-and-release.yml b/.github/workflows/test-and-release.yml
index ab2f05d..9577406 100644
--- a/.github/workflows/test-and-release.yml
+++ b/.github/workflows/test-and-release.yml
@@ -26,6 +26,9 @@ jobs:
           npm run test:ci
   release:
     name: Release
+    permissions:
+      contents: write
+      id-token: write
     needs: test
     runs-on: ubuntu-latest
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
@@ -38,6 +41,7 @@ jobs:
         uses: actions/setup-node@v6.2.0
         with:
           node-version: lts/*
+          registry-url: 'https://registry.npmjs.org'
       - name: Install dependencies
         run: |
           npm install --no-progress --no-package-lock --no-save
@@ -58,6 +62,6 @@ jobs:
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true
         run: npx semantic-release