From a4bef197f84e37dd41fc0e5f502aec151f3bf6d6 Mon Sep 17 00:00:00 2001
From: Peter Chang <peter.chang@diamond.ac.uk>
Date: Fri, 3 Oct 2025 08:39:52 +0100
Subject: [PATCH] Configure npm workflow for trusted publishing

---
 .github/workflows/npm-publish.yaml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/npm-publish.yaml b/.github/workflows/npm-publish.yaml
index f157de27..b9348ecc 100644
--- a/.github/workflows/npm-publish.yaml
+++ b/.github/workflows/npm-publish.yaml
@@ -8,10 +8,16 @@ on:
     tags:
       - v*
 
-
 jobs:
   publish-npm:
     runs-on: ubuntu-latest
+
+    permissions:
+      id-token: write  # Required for OIDC
+      contents: read
+
+    environment: release
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -39,5 +45,4 @@ jobs:
 
       - name: Publish
         run: pnpm publish -r --no-git-checks --access public
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN_DLS}}
+