fix(ci): publishing doesn't work (#570)

GitHub and NPM recently introduced tighter security on the publishing
process for NPM packages. More info can be found here: https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/

To use trusted publishing without tokens, we have to slightly change
the publishing config. Most notably we had to upgrade semantic-release
since it only supports from version 25 the trusted publishing process.

Example config can be found here: https://github.com/semantic-release/semantic-release/blob/c58fe12f90022b4d6c6e34fc0eb0e4f7b21e815a/docs/recipes/ci-configurations/github-actions.md#githubworkflowsreleaseyml-configuration-for-node-projects

SREI-3017

Author: molikuner

.github/workflows/library.yml

@@ -18,7 +18,7 @@ jobs:
                   fetch-depth: 0
             - uses: actions/setup-node@v4
               with:
-                  node-version: 18
+                  node-version: 24
             - name: Install dependencies
               uses: bahmutov/npm-install@v1
             - name: Run linter
@@ -31,22 +31,25 @@ jobs:
     release:
         if: github.ref == 'refs/heads/main'
         runs-on: ubuntu-latest
+        permissions:
+            id-token: write # to enable use of OIDC for trusted publishing and npm provenance
         steps:
             - uses: actions/checkout@v4
               with:
                   fetch-depth: 0
             - uses: actions/setup-node@v4
               with:
-                  node-version: 18
+                  node-version: 24
             - name: Install dependencies
               uses: bahmutov/npm-install@v1
+            - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies
+              run: npm audit signatures
             - name: Run build
               run: npm run build
             - name: Release
               run: npx semantic-release
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-                  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
     merge-main:
         if: github.ref == 'refs/heads/main'