Use OIDC for publishing

Author: jakebailey

.changeset/salty-bugs-act.md

@@ -0,0 +1,5 @@
+---
+'hereby': patch
+---
+
+Enable OIDC publishing

.github/workflows/release.yml

@@ -23,22 +23,35 @@ jobs:
   publish:
     needs: [build]
     runs-on: ubuntu-latest
+
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
-      - name: Set up Node registry authentication
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
-          node-version: 22.20.0
-          registry-url: 'https://registry.npmjs.org'
+          node-version: '*'
+
+      - run: npm install -g npm@latest
 
-      - name: publish
-        id: publish
-        uses: slsa-framework/slsa-github-generator/actions/nodejs/publish@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0
+      - name: Download tarball
+        uses: slsa-framework/slsa-github-generator/actions/nodejs/[email protected]
         with:
-          access: public
-          node-auth-token: ${{ secrets.NPM_TOKEN }}
-          package-name: ${{ needs.build.outputs.package-name }}
-          package-download-name: ${{ needs.build.outputs.package-download-name }}
-          package-download-sha256: ${{ needs.build.outputs.package-download-sha256 }}
-          provenance-name: ${{ needs.build.outputs.provenance-name }}
-          provenance-download-name: ${{ needs.build.outputs.provenance-download-name }}
-          provenance-download-sha256: ${{ needs.build.outputs.provenance-download-sha256 }}
+          name: ${{ needs.build.outputs.package-download-name }}
+          path: ${{ needs.build.outputs.package-name }}
+          sha256: ${{ needs.build.outputs.package-download-sha256 }}
+
+      - name: Download provenance
+        uses: slsa-framework/slsa-github-generator/actions/nodejs/[email protected]
+        with:
+          name: ${{ needs.build.outputs.provenance-download-name }}
+          path: 'attestations'
+          sha256: ${{ needs.build.outputs.provenance-download-sha256 }}
+
+      - name: Publish the package
+        env:
+          TARBALL_PATH: '${{ needs.build.outputs.package-name }}'
+          PROVENANCE_PATH: './attestations/${{ needs.build.outputs.provenance-name }}'
+        run: |
+          npm publish "${TARBALL_PATH}" --access=public --provenance-file="${PROVENANCE_PATH}"