ci: publish to npm via trusted publishing instead of a token

.github/actions/prepare/action.yml

@@ -9,7 +9,8 @@ runs:
         bun-version: latest
     - uses: actions/setup-node@v4
       with:
-        node-version: 24.3.0
+        # >=24.5.0 for npm >=11.5.1, the minimum for npm trusted publishing.
+        node-version: 24.19.0
     - run: bun install --frozen-lockfile
       shell: bash
   using: composite

.github/workflows/release.yml

@@ -20,13 +20,14 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: ./.github/actions/prepare
       - run: bun run build
-      - name: Set up npm auth
-        run: |
-          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
+      # Publishes to npmjs via trusted publishing (OIDC) — no NPM_TOKEN. The
+      # `id-token: write` permission below is what makes it work, and npm must
+      # have a Trusted Publisher configured for this repo pointing at
+      # `release.yml`. Provenance is generated automatically, so `.release-it.json`
+      # does not pass `--provenance`.
       - uses: JoshuaKGoldberg/release-it-action@v0.3.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       - name: Publish to GitHub Packages
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.release-it.json

@@ -4,7 +4,7 @@
 		"requireCommits": true
 	},
 	"github": { "release": true, "releaseName": "v${version}" },
-	"npm": { "publishArgs": ["--access public", "--provenance"] },
+	"npm": { "publishArgs": ["--access public"], "skipChecks": true },
 	"plugins": {
 		"@release-it/conventional-changelog": {
 			"infile": "CHANGELOG.md",