From a18308d16a721db375cb601c07c1d0341c183cbc Mon Sep 17 00:00:00 2001
From: David Goss <david@davidgoss.co>
Date: Thu, 18 Sep 2025 14:16:35 +0100
Subject: [PATCH 1/2] Setup trusted publishing with npm

---
 .github/workflows/release-npm.yaml | 24 ------------------------
 .github/workflows/release-npm.yml  | 25 +++++++++++++++++++++++++
 2 files changed, 25 insertions(+), 24 deletions(-)
 delete mode 100644 .github/workflows/release-npm.yaml
 create mode 100644 .github/workflows/release-npm.yml

diff --git a/.github/workflows/release-npm.yaml b/.github/workflows/release-npm.yaml
deleted file mode 100644
index cd6c9f37..00000000
--- a/.github/workflows/release-npm.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-name: Release NPM
-
-on:
-  push:
-    branches: [release/*]
-
-jobs:
-  publish-npm:
-    name: Publish NPM module
-    runs-on: ubuntu-latest
-    environment: Release
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22.x'
-          cache: 'npm'
-          cache-dependency-path: package-lock.json
-      - run: npm ci
-      - run: npm run compile
-      - uses: cucumber/action-publish-npm@v1.1.1
-        with:
-          npm-token: ${{ secrets.NPM_TOKEN }}
-          npm-tag: 'latest'
diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml
new file mode 100644
index 00000000..4ea6150a
--- /dev/null
+++ b/.github/workflows/release-npm.yml
@@ -0,0 +1,25 @@
+name: Release NPM
+
+on:
+  push:
+    branches: [release/*]
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  publish-npm:
+    name: Publish NPM module
+    runs-on: ubuntu-latest
+    environment: Release
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: '24.x'
+          cache: 'npm'
+          cache-dependency-path: package-lock.json
+          registry-url: 'https://registry.npmjs.org'
+      - run: npm install-ci-test
+      - run: npm publish

From bffca1decea948fe31d974c12923da3df327f850 Mon Sep 17 00:00:00 2001
From: David Goss <david@davidgoss.co>
Date: Thu, 18 Sep 2025 14:18:46 +0100
Subject: [PATCH 2/2] add missing prepublishOnly

---
 package.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ed0a08af..1aa46774 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,8 @@
     "build": "ladle build",
     "preview": "ladle preview",
     "fix": "eslint --max-warnings 0 src test-utils --fix src && prettier --write src test-utils",
-    "lint": "eslint --max-warnings 0 src test-utils && prettier --check src test-utils"
+    "lint": "eslint --max-warnings 0 src test-utils && prettier --check src test-utils",
+    "prepublishOnly": "npm run compile"
   },
   "dependencies": {
     "@cucumber/gherkin-utils": "10.0.0",