ci: Publish to npm with trusted publishing

.github/workflows/_build.yml

@@ -9,6 +9,11 @@ on:
         type: string
         required: false
         default: '20'
+      ref:
+        description: The git ref to build (defaults to the triggering ref).
+        type: string
+        required: false
+        default: ''
     outputs:
       artifact_name:
         description: The artifact name.
@@ -22,6 +27,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
       - name: Setup
         uses: ./.github/actions/setup
         with:

.github/workflows/_publish.yml

@@ -15,7 +15,7 @@ on:
     secrets:
       registry_token:
         description: The package registry token.
-        required: true
+        required: false
 
 jobs:
   publish:
@@ -28,6 +28,7 @@ jobs:
       - name: Setup
         uses: ./.github/actions/setup
         with:
+          node_version: '24'
           install_dependencies: 'false'
       - name: Download artifact
         uses: actions/download-artifact@v4
@@ -38,7 +39,7 @@ jobs:
         id: meta
         run: echo "tgz=$(ls *.tgz | head -n1)" >> $GITHUB_OUTPUT
       - name: Publish
-        uses: JS-DevTools/npm-publish@v3
+        uses: JS-DevTools/npm-publish@v4
         with:
           access: public
           token: ${{ secrets.registry_token }}

.github/workflows/publish.yml

@@ -1,19 +1,27 @@
 ---
 name: Publish
 
-run-name: Publish ${{ github.ref_name }}
+run-name: Publish ${{ inputs.tag || github.ref_name }}
 
 on:
   push:
     tags:
       - v*
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing version tag to publish to npm (e.g. v1.2.3)
+        required: true
 
 jobs:
   build:
     name: Build
     uses: ./.github/workflows/_build.yml
+    with:
+      ref: ${{ inputs.tag }}
   release:
     name: GitHub Releases
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     needs: build
@@ -47,13 +55,15 @@ jobs:
     name: npm
     uses: ./.github/workflows/_publish.yml
     needs: build
+    permissions:
+      contents: read
+      id-token: write
     with:
       artifact_name: ${{ needs.build.outputs.artifact_name }}
       registry_url: https://registry.npmjs.org
-    secrets:
-      registry_token: ${{ secrets.NPM_TOKEN }}
   github:
     name: GitHub Packages
+    if: github.event_name == 'push'
     uses: ./.github/workflows/_publish.yml
     permissions:
       contents: read