OIDC publish workflow

Author: cyrilletuzi

.github/workflows/publish.yml

@@ -0,0 +1,25 @@
+name: Publish package
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  id-token: write # Required for OIDC
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: npm ci
+      - run: npm run build
+      - run: npm publish ./dist/lib --access public

package.json

@@ -22,9 +22,7 @@
     "release:patch": "VERSION=patch npm run release",
     "release:minor": "VERSION=minor npm run release",
     "release:major": "VERSION=major npm run release",
-    "release:premajor": "VERSION=premajor TAG=next npm run release",
-    "release:prerelease": "VERSION=prerelease TAG=next npm run release",
-    "release": "if test $VERSION; then npm run build && cd lib && npm version $VERSION --no-git-tag-version && git add package.json && cd .. && git commit -m \"release\" && npm version $VERSION && npm run build && npm publish ./dist/lib --access public --tag ${TAG:-latest} && git push; fi"
+    "release": "if test $VERSION; then npm run build && cd lib && npm version $VERSION --no-git-tag-version && git add package.json && cd .. && git commit -m \"release\" && npm version $VERSION && git push && git push origin v$npm_package_version; fi"
   },
   "private": true,
   "dependencies": {
@@ -62,4 +60,4 @@
     "typescript-eslint": "^8.33.0",
     "zone.js": "^0.15.1"
   }
-}
+}