ci: add trusted publishing release step

Author: danielroe

.github/workflows/release.yml

@@ -1,7 +1,6 @@
 name: release
 
-permissions:
-  contents: write
+permissions: {}
 
 on:
   push:
@@ -11,19 +10,30 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    concurrency:
+      group: release
+    permissions:
+      contents: write
+      id-token: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
+
       - run: corepack enable
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          node-version: lts/-1
-          cache: pnpm
+          node-version: latest
 
       - name: 📦 Install dependencies
         run: pnpm install
 
+      - name: 🛠 Build project
+        run: pnpm build
+
+      - name: 📦 Release
+        run: pnpm publish --no-git-checks
+
       - run: pnpm changelogithub
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package.json

@@ -26,7 +26,7 @@
     "prepare": "simple-git-hooks",
     "prepack": "pnpm build",
     "prepublishOnly": "pnpm lint && pnpm test",
-    "release": "bumpp && pnpm publish",
+    "release": "bumpp",
     "test": "pnpm test:unit && pnpm test:types",
     "test:unit": "vitest",
     "test:types": "tsc --noEmit && pnpm -r test:types"