Publish to npm via trusted publishing (#30)

Replaces the NPM_TOKEN secret with OIDC, so there is no long-lived
publishing credential in the repository.

We're trying a separate job to limit the scope of the token but need to check
this works in practice.

Author: microbit-matt-hillsdon

.github/workflows/build.yml

@@ -5,30 +5,50 @@ on:
   push:
     branches:
       - '**'
+env:
+  # renovate: datasource=npm depName=npm
+  NPM_VERSION: '11'
+
 jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: '24.x'
-          registry-url: 'https://registry.npmjs.org'
           cache: npm
-      - run: npm install -g npm@11 --registry=https://registry.npmjs.org
+      - run: npm install -g npm@${{ env.NPM_VERSION }} --registry=https://registry.npmjs.org
       - uses: microbit-foundation/npm-package-versioner-action@v3
       - run: npm ci
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - run: npm run ci
-      - name: Upload GitHub packages artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
+      - run: npm pack
+        if: github.event_name == 'release'
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: github.event_name == 'release'
+        with:
+          name: npm-tarball
+          path: '*.tgz'
+          if-no-files-found: error
+          retention-days: 1
+
+  publish:
+    needs: build
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    environment: npm-publish
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: npm-tarball
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          path: ./storybook-static
-      - run: npm publish --allow-directory=all
-        if: github.event_name == 'release' && github.event.action == 'created'
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          node-version: '24.x'
+          registry-url: 'https://registry.npmjs.org'
+      - run: npm install -g npm@${{ env.NPM_VERSION }} --registry=https://registry.npmjs.org
+      - run: npm stage publish --allow-file=all ./*.tgz