CI: Set `id-token` permission for release job #49

	name: CI

	on:
	push:
	branches: [ "main" ]
	pull_request:
	branches: [ "main" ]
	merge_group:

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

	jobs:
	build:
	name: Build / Node ${{ matrix.node-version }}
	runs-on: ubuntu-latest

	strategy:
	matrix:
	node-version: [ 18, 20, 21 ]

	steps:
	- uses: actions/checkout@v4
	- name: Use Node.js ${{ matrix.node-version }}
	uses: actions/setup-node@v4
	with:
	node-version: ${{ matrix.node-version }}
	cache: 'npm'
	- run: npm ci
	- run: npm test

	success:
	name: Success
	needs: [build]
	runs-on: ubuntu-latest
	if: always()
	steps:
	- run: jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
	- run: exit 0

	publish-npm:
	name: Publish / npm
	runs-on: ubuntu-latest
	needs: [success]
	if: github.event_name == 'push'
	permissions:
	contents: write
	id-token: write
	pull-requests: write
	steps:
	- name: Checkout Repo
	uses: actions/checkout@v4

	- name: Setup Node.js 21
	uses: actions/setup-node@v4
	with:
	node-version: 21
	cache: 'npm'
	registry-url: 'https://registry.npmjs.org'

	- name: Install Dependencies
	run: npm ci

	- uses: tibdex/github-app-token@v2
	id: generate-token
	with:
	app_id: ${{ secrets.GW2T_RELEASE_APP_ID }}
	private_key: ${{ secrets.GW2T_RELEASE_APP_PRIVATE_KEY }}

	- name: Create Release Pull Request
	uses: changesets/action@v1
	env:
	GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
	NPM_CONFIG_PROVENANCE: true
	NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
	with:
	publish: npm run release

Provide feedback