From 1abe49e881fc52562c99f35e476be4ef8f19b657 Mon Sep 17 00:00:00 2001
From: Joshua Diablito <joshua@diablitodevelopment.com>
Date: Thu, 30 Apr 2026 14:20:49 +0100
Subject: [PATCH 1/2] Update the release action

---
 .github/workflows/release.yml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..df0d2e4
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,33 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      git_tag:
+        description: 'Git tag to publish a release for (eg. v0.0.0)'
+        required: true
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: '${{ github.event.inputs.git_tag }}'
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Update npm
+        run: npm install -g npm@latest
+
+      - name: Publish to NPM
+        run: |
+          make ci
+          echo ""
+          echo "Publishing"
+          npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

From 48e8543d2af81cb949ad580dda296bb24d8ff024 Mon Sep 17 00:00:00 2001
From: Joshua Diablito <joshua@diablitodevelopment.com>
Date: Thu, 30 Apr 2026 14:26:24 +0100
Subject: [PATCH 2/2] Use OIDC

---
 .github/workflows/release.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index df0d2e4..852701b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,10 @@ on:
         description: 'Git tag to publish a release for (eg. v0.0.0)'
         required: true
 
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -20,6 +24,7 @@ jobs:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
 
+      # Required to resolve an issue with publishing provenance
       - name: Update npm
         run: npm install -g npm@latest
 
@@ -28,6 +33,5 @@ jobs:
           make ci
           echo ""
           echo "Publishing"
-          npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          npm publish --no-provenance
+        # Note: Do NOT set NODE_AUTH_TOKEN!