fix: npm permissions

kulshekhar · web-flow · commit e2eec26aa127 · 2026-04-01T19:28:37.000+05:30
Add permissions for id-token and contents in publish step.
diff --git a/.github/workflows/release-and-publish.yml b/.github/workflows/release-and-publish.yml
@@ -63,6 +63,9 @@ jobs:
           prerelease: ${{ needs.setup_variables.outputs.isLatest != 'true' }}
 
   publish_to_npm:
+    permissions:
+      id-token: write
+      contents: read
     needs: [setup_variables, create_release]
     runs-on: ubuntu-latest
 
@@ -78,6 +81,10 @@ jobs:
           os: ubuntu-latest
           node-version: 22
 
+      # EDIT 2: Upgrade npm to the required version for Trusted Publishing
+      - name: Upgrade npm
+        run: npm install -g npm@latest
+
       - name: Build 🔧
         run: |
           npm run build
