From 5346530575ecba2b68ecd8649a37f44d80da6b24 Mon Sep 17 00:00:00 2001
From: Justintime50 <39606064+Justintime50@users.noreply.github.com>
Date: Thu, 17 Sep 2026 10:13:37 -0600
Subject: [PATCH] chore: update release workflow for trusted publishing

---
 .github/workflows/release.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b23269a8d..924e46f8e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,10 @@ on:
     types: [published]
   workflow_dispatch: ~
 
+permissions:
+  id-token: write # Required for OIDC
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -15,16 +19,13 @@ jobs:
         with:
           node-version: 26
           registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false # never use caching in release builds
       - name: Publish Stable Package
         if: ${{ github.event_name == 'workflow_dispatch' || !github.event.release.prerelease }}
         run: EASYPOST_TEST_API_KEY=123 EASYPOST_PROD_API_KEY=123 just install publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_API_KEY }}
       - name: Publish Release Candidate Package
         if: ${{ github.event_name == 'release' && github.event.release.prerelease }}
         run: EASYPOST_TEST_API_KEY=123 EASYPOST_PROD_API_KEY=123 just install publish-next
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_API_KEY }}
       - name: Upload assets to release
         uses: AButler/upload-release-assets@v3.0.1
         with: