Switch npm publish workflow to trusted publishing #2

	name: Publish

	on:
	push:
	tags:
	- "v*"

	jobs:
	publish:
	runs-on: ubuntu-latest

	permissions:
	contents: write
	id-token: write

	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: 20
	registry-url: https://registry.npmjs.org
	cache: npm

	- name: Install dependencies
	run: npm ci

	- name: Typecheck
	run: npm run typecheck

	- name: Run tests
	run: npm test

	- name: Build package
	run: npm run build

	- name: Publish to npm
	run: npm publish --access public --provenance

	- name: Extract release notes from changelog
	id: changelog
	run: \|
	VERSION="${GITHUB_REF_NAME#v}"
	awk -v version="$VERSION" '
	$0 ~ "^## \\[" version "\\]" { capture=1; next }
	capture && $0 ~ "^## \\[" { exit }
	capture { print }
	' CHANGELOG.md \| sed '/./,$!d' > release-notes.md

	if [ ! -s release-notes.md ]; then
	echo "No changelog entry found for version ${VERSION}" >&2
	exit 1
	fi

	- name: Create GitHub release
	uses: softprops/action-gh-release@v2
	with:
	tag_name: ${{ github.ref_name }}
	name: ${{ github.ref_name }}
	body_path: release-notes.md

Provide feedback