Switch to pnpm and trusted publishing

.github/workflows/release.yaml

@@ -1,18 +1,29 @@
 name: npm publish
 on:
-  release:
-    types: [created]
+    release:
+        types: [published]
+
+permissions:
+    contents: read
+    id-token: write
+
 jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
-        with:
-          node-version: '16'
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm install
-      - run: npm test
-      - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+    publish:
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: actions/checkout@v6
+              with:
+                  persist-credentials: false
+
+            - uses: actions/setup-node@v6
+              with:
+                  node-version: "24"
+
+            - uses: pnpm/action-setup@v4
+              with:
+                  version: 10
+
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm run build
+            - run: pnpm publish

.github/workflows/test.yaml

@@ -1,13 +1,24 @@
-name: npm test
+name: test
 on: [push]
+
+permissions:
+    contents: read
+
 jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
-        with:
-          node-version: '16'
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm install
-      - run: npm test
+    build:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v6
+              with:
+                  persist-credentials: false
+
+            - uses: actions/setup-node@v6
+              with:
+                  node-version: "24"
+
+            - uses: pnpm/action-setup@v4
+              with:
+                  version: 10
+
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm run build