Switch to trusted publishing

[eps1lon]

Followed docs.npmjs.com/trusted-publishers

[changeset-bot]

🦋 Changeset detected

Latest commit: 5901c36

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
types-react-codemod	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Copilot]

Pull request overview

This PR modernizes the npm publishing workflow by switching from token-based authentication to OIDC-based trusted publishing, following npm's trusted publishers documentation.

• Adds OIDC configuration with id-token: write permission and production environment
• Removes the deprecated NPM_AUTOMATION_TOKEN secret usage
• Adds necessary permissions for changesets to manage releases (contents, pull-requests)

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/release.yml	Configures OIDC authentication by adding environment, permissions, and removing NPM_TOKEN secret
.changeset/light-mirrors-tickle.md	Documents the switch to trusted publishing as a patch change

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

When using npm trusted publishing with OIDC, the publish command should include the --provenance flag to generate attestations. Add publishArgs: '--provenance' to the changesets action configuration:

- name: Create Release Pull Request or Publish to npm
  id: changesets
  uses: changesets/action@v1
  with:
    publish: yarn release
    publishArgs: '--provenance'
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

This ensures that npm packages are published with provenance attestations, which is a key benefit of trusted publishing.

Suggested change

	publish: yarn release
	publish: yarn release
	publishArgs: '--provenance'

[eps1lon]

This should no longer be needed.