Setup trusted publishing to NPM

.github/actions/setup/action.yml

@@ -4,7 +4,9 @@ inputs:
   node-version:
     description: The version of Node.js to install
     required: true
-    default: 20.16.0
+    default: 23.7.0
+  registry-url:
+    description: Optional registry to set up for auth
 
 runs:
   using: composite
@@ -16,6 +18,7 @@ runs:
       with:
         cache: pnpm
         node-version: ${{ inputs.node-version }}
+        registry-url: ${{ inputs.registry-url }}
     - name: Install dependencies
       shell: bash
       run: pnpm install

.github/workflows/main.yml

@@ -23,6 +23,10 @@ jobs:
       - uses: actions/checkout@v4
       - name: Install dependencies
         uses: ./.github/actions/setup
+        with:
+          registry-url: "https://registry.npmjs.org"
+      - name: Upgrade npm for OIDC support
+        run: npm install -g npm@latest
       - name: Create Release Pull Request or Publish
         id: changesets
         uses: changesets/action@v1
@@ -31,4 +35,3 @@ jobs:
           publish: pnpm changeset-publish
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/pages.yml

@@ -31,7 +31,7 @@ jobs:
           destination: ./_site
       - name: Upload pages artifact
         if: github.repository_owner == 'Effect-Ts' && github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/upload-pages-artifact@v2
+        uses: actions/upload-pages-artifact@v3
 
   deploy:
     if: github.repository_owner == 'Effect-Ts' && github.event_name == 'push' && github.ref == 'refs/heads/main'
@@ -48,4 +48,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v2
+        uses: actions/deploy-pages@v4