Workflow: Publish - Attempt to switch to new npm trusted publishing

@see https://docs.npmjs.com/trusted-publishers

Author: nicolas-jaussaud

.github/workflows/publish.yml

@@ -1,5 +1,9 @@
 name: Publish NPM package
 permissions:
+  # Note: Because this workflow is call from release, the
+  # trusted publisher workflow will be release.yml
+  # see https://docs.npmjs.com/trusted-publishers
+  id-token: write
   contents: write
 on:
   # Release workflow calls this after shared test step succeeds
@@ -12,15 +16,16 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+      - name: Setup NPM
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
       - name: Install dependencies
-        run: bun install
+        run: npm install
       - name: Build NPM package
-        run: bun run build:npm
+        run: npm run build:npm
       - name: Publish NPM package
         run: |
           cd publish/npm
-          bun publish --access public
-        env:
-          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
+          npm publish --access public

.github/workflows/release.yml

@@ -1,5 +1,6 @@
 name: Release
 permissions:
+  id-token: write
   contents: write
 on:
   push: