From c9c2bc2eea1855675dda5d1325f3a0a765444b5f Mon Sep 17 00:00:00 2001
From: Abdirahim Musse <33973272+abmusse@users.noreply.github.com>
Date: Mon, 21 Sep 2026 17:03:18 -0500
Subject: [PATCH] ci: Use trusted publisher

- Update actions to latest versions
- Add npm-tag.sh to publish to correct npm tag
---
 .github/npm-tag.sh            |  8 ++++++++
 .github/workflows/publish.yml | 34 ++++++++++++++++++++++++----------
 2 files changed, 32 insertions(+), 10 deletions(-)
 create mode 100644 .github/npm-tag.sh

diff --git a/.github/npm-tag.sh b/.github/npm-tag.sh
new file mode 100644
index 0000000..d435c51
--- /dev/null
+++ b/.github/npm-tag.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+case "$1" in
+    *-rc*) echo tag=rc;;
+    *-beta*) echo tag=beta;;
+    *-alpha*) echo tag=alpha;;
+    *) echo tag=latest;;
+esac
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b6a0f6b..69a0b27 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,22 +5,36 @@ on:
     tags:
       - "v*.*.*"
 
+permissions:
+  id-token: write  # Required for OIDC
+  contents: write  # Required for action-gh-release
+
 jobs:
-  npm-publish-and-gh-release:
+  npm-gh-release-and-publish:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org/
-      - run: npm ci
-      - run: npm test
-      - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.npm_token}}
-      - uses: softprops/action-gh-release@v1
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org/'
+
+      - name: Create Release
+        uses: softprops/action-gh-release@v3
         with:
           generate_release_notes: true
-          token: ${{ secrets.GH_TOKEN }}
 
+      - name: get-npm-version
+        id: package-version
+        run: jq -r '"version=" + .version' package.json  >> "$GITHUB_OUTPUT"
+
+      - name: get-npm-tag
+        id: package-tag
+        run: .github/npm-tag.sh $PACKAGE_VERSION >> "$GITHUB_OUTPUT"
+        env:
+          PACKAGE_VERSION: ${{ steps.package-version.outputs.version }}
+
+      - name: Publish to NPM
+        run: npm publish --tag $PACKAGE_TAG
+        env:
+          PACKAGE_TAG: ${{ steps.package-tag.outputs.tag }}