Merge 282a44f5c5 into 967b54195c

.github/workflows/release.yaml

@@ -12,9 +12,6 @@ jobs:
     defaults:
       run:
         working-directory: packages/npm
-    permissions:
-      contents: read
-      id-token: write
     steps:
       - name: 🧮 Checkout code
         uses: actions/checkout@v4
@@ -26,10 +23,6 @@ jobs:
           cache-dependency-path: packages/npm/yarn.lock
           registry-url: "https://registry.npmjs.org"
 
-      # Ensure npm 11.5.1 or later is installed
-      - name: Update npm
-        run: npm install -g npm@latest
-
       - name: 🔨 Install dependencies
         run: "yarn install --frozen-lockfile"
 
@@ -40,4 +33,10 @@ jobs:
           VERSION: ${{ github.event.release.tag_name }}.0
 
       - name: 🚀 Publish to npm
-        run: npm publish --provenance --access public --tag latest
+        id: npm-publish
+        uses: JS-DevTools/npm-publish@19c28f1ef146469e409470805ea4279d47c3d35c # v3.1.1
+        with:
+          token: ${{ secrets.NPM_TOKEN }}
+          package: packages/npm
+          access: public
+          ignore-scripts: false

changelogs/internal/newsfragments/2239.clarification

@@ -1 +0,0 @@
-Use NPM Trusted Publishers for publishing `@matrix-org/spec` to npm.