fix: switch to npm OIDC trusted publishing (#38)

NPM_TOKEN will be invalidated any day now

Author: travis

.github/workflows/release.yml

@@ -20,30 +20,25 @@ jobs:
           release-type: node
           package-name: indexing-service-client
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         if: ${{ steps.release.outputs.release_created }}
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         if: ${{ steps.release.outputs.release_created }}
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24
           registry-url: https://registry.npmjs.org/
           cache: 'pnpm'
         if: ${{ steps.release.outputs.release_created }}
-      - name: Update NPM
-        run: npm install -g npm@11
-        if: ${{ steps.release.outputs.release_created }}
       - name: Install Dependencies
         run: pnpm install
         if: ${{ steps.release.outputs.release_created }}
       - name: Build
         run: pnpm build
         if: ${{ steps.release.outputs.release_created }}
       - name: Publish to npm
-        run: npm publish --access=public
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+        run: pnpm publish --access=public
         if: ${{ steps.release.outputs.release_created }}
 

README.md

@@ -24,3 +24,4 @@ Feel free to join in. All welcome. [Open an issue](https://github.com/storacha/j
 ## License
 
 Dual-licensed under [MIT / Apache 2.0](https://github.com/storacha/js-indexing-service-client/blob/main/LICENSE.md)
+