ci: migrate npm publishing to OIDC

Author: devfive

.changepacks/config.json

@@ -3,6 +3,9 @@
   "baseBranch": "main",
   "latestPackage": null,
   "publish": {
-    "node": "bun publish"
+    "node": "bun pm pack --quiet --filename .changepacks/publish.tgz && npm publish ../../.changepacks/publish.tgz"
+  },
+  "publishDryRun": {
+    "node": "bun pm pack --quiet --filename .changepacks/publish.tgz && npm publish ../../.changepacks/publish.tgz --dry-run"
   }
 }

.github/workflows/publish.yml

@@ -46,20 +46,24 @@ jobs:
       # Actions > General > Workflow permissions for creating pull request
       # Create brench to create pull request
       contents: write
+      id-token: write
     needs:
       - check
     steps:
       - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.12
+      - name: Install Node.js
+        uses: actions/setup-node@v7
+        with:
+          registry-url: "https://registry.npmjs.org"
+          node-version: 24
       - run: bun i
       - run: bun run build
       - uses: changepacks/action@main
         id: changepacks
         with:
           publish: true
-        env:
-          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
     outputs:
       changepacks: ${{ steps.changepacks.outputs.changepacks }}

packages/core/package.json

@@ -2,6 +2,7 @@
   "name": "@devup-api/core",
   "version": "0.1.20",
   "license": "Apache-2.0",
+  "repository": "https://github.com/dev-five-git/devup-api",
   "type": "module",
   "exports": {
     ".": {

packages/fetch/package.json

@@ -2,6 +2,7 @@
   "name": "@devup-api/fetch",
   "version": "0.1.23",
   "license": "Apache-2.0",
+  "repository": "https://github.com/dev-five-git/devup-api",
   "type": "module",
   "exports": {
     ".": {

packages/generator/package.json

@@ -2,6 +2,7 @@
   "name": "@devup-api/generator",
   "version": "0.1.26",
   "license": "Apache-2.0",
+  "repository": "https://github.com/dev-five-git/devup-api",
   "type": "module",
   "exports": {
     ".": {

packages/hookform/package.json

@@ -2,6 +2,7 @@
   "name": "@devup-api/hookform",
   "version": "0.1.7",
   "license": "Apache-2.0",
+  "repository": "https://github.com/dev-five-git/devup-api",
   "type": "module",
   "exports": {
     ".": {

packages/next-plugin/package.json

@@ -2,6 +2,7 @@
   "name": "@devup-api/next-plugin",
   "version": "0.1.15",
   "license": "Apache-2.0",
+  "repository": "https://github.com/dev-five-git/devup-api",
   "type": "module",
   "exports": {
     ".": {

packages/react-query/package.json

@@ -2,6 +2,7 @@
   "name": "@devup-api/react-query",
   "version": "0.1.17",
   "license": "Apache-2.0",
+  "repository": "https://github.com/dev-five-git/devup-api",
   "type": "module",
   "exports": {
     ".": {

packages/rsbuild-plugin/package.json

@@ -2,6 +2,7 @@
   "name": "@devup-api/rsbuild-plugin",
   "version": "0.1.15",
   "license": "Apache-2.0",
+  "repository": "https://github.com/dev-five-git/devup-api",
   "type": "module",
   "exports": {
     ".": {

packages/ui/package.json

@@ -2,6 +2,7 @@
   "name": "@devup-api/ui",
   "version": "0.1.4",
   "license": "Apache-2.0",
+  "repository": "https://github.com/dev-five-git/devup-api",
   "type": "module",
   "exports": {
     ".": {