repare actions

Author: oscarlevin

.github/workflows/publish-completions.yml

@@ -13,6 +13,10 @@ on:
           - "minor"
           - "major"
 
+permissions:
+  id-token: write
+  contents: write
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -43,11 +47,9 @@ jobs:
         run: echo "VERSION=$(jq -r '.version' packages/completions/package.json)" >> $GITHUB_OUTPUT
 
       - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           cd packages/completions
-          npm publish
+          npm publish --provenance
 
       - name: Commit and Push
         run: |

.github/workflows/publish-format.yml

@@ -13,6 +13,10 @@ on:
           - "minor"
           - "major"
 
+permissions:
+  id-token: write
+  contents: write
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -43,11 +47,9 @@ jobs:
         run: echo "VERSION=$(jq -r '.version' packages/format/package.json)" >> $GITHUB_OUTPUT
 
       - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           cd packages/format
-          npm publish
+          npm publish --provenance
 
       - name: Commit and Push
         run: |

.github/workflows/publish-latex-pretext.yml

@@ -23,6 +23,10 @@ on:
         type: string
         default: "main"
 
+permissions:
+  id-token: write
+  contents: write
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -63,11 +67,9 @@ jobs:
         run: echo "VERSION=$(jq -r '.version' packages/latex-pretext/package.json)" >> $GITHUB_OUTPUT
 
       - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           cd packages/latex-pretext
-          npm publish
+          npm publish --provenance
 
       - name: Commit and Push
         run: |

.github/workflows/publish-visual-editor.yml

@@ -13,6 +13,10 @@ on:
           - "minor"
           - "major"
 
+permissions:
+  id-token: write
+  contents: write
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -43,11 +47,9 @@ jobs:
         run: echo "VERSION=$(jq -r '.version' packages/visual-editor/package.json)" >> $GITHUB_OUTPUT
 
       - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           cd packages/visual-editor
-          npm publish
+          npm publish --provenance
 
       - name: Commit and Push
         run: |