From 1308daba4c8b08c9470a11a96c3db68c2b6e1ecb Mon Sep 17 00:00:00 2001
From: Xiaoji Chen <cxiaoji@gmail.com>
Date: Wed, 2 Sep 2026 13:40:50 -0700
Subject: [PATCH] chore: use npm trusted publishing

---
 .github/workflows/release.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8637a9522..62517851a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,12 +34,12 @@ jobs:
     needs: check_branch
     permissions:
       contents: write
+      id-token: write
 
     if: ${{ github.repository_owner == 'visgl' && needs.check_branch.outputs.should_build }}
 
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      NPM_ACCESS_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -48,6 +48,11 @@ jobs:
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: '.nvmrc'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
+
+      - name: Update npm
+        run: npm install --global npm@^11.15.0
 
       - name: Enable Corepack
         run: corepack enable yarn
@@ -64,8 +69,5 @@ jobs:
       - name: Run tests
         run: yarn test
 
-      - name: Login to NPM
-        run: npm config set "//registry.npmjs.org/:_authToken=${NPM_ACCESS_TOKEN}"
-
       - name: Publish to NPM
         run: npx ocular-publish from-git