feat: support npm trusted publisher

close #14

Author: fengmk2

.github/workflows/npm-release.yml

@@ -0,0 +1,93 @@
+name: NPM Trusted Publisher
+
+on:
+  workflow_call:
+    inputs:
+      checkTest:
+        type: boolean
+        description: whether run test before release
+        default: false
+
+      dryRun:
+        type: boolean
+        description: pass dry-run to semantic-release
+        default: false
+
+      install:
+        type: string
+        description: 'Install dependencies script'
+        default: 'npm i --no-package-lock --no-fund --force && rm -rf package-lock.json'
+
+      action_ref:
+        type: string
+        description: 'Branch name for node-modules/github-actions, for test purpose'
+        default: master
+
+jobs:
+  Release:
+    permissions:
+      contents: write
+      id-token: write # Required for OIDC
+      deployments: write
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: main_repo
+
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+
+    steps:
+      # Checkout action repository
+      - name: Checkout action repository
+        uses: actions/checkout@v4
+        with:
+          repository: node-modules/github-actions
+          path: action_repo
+          ref: ${{ inputs.action_ref }}
+
+      # Checkout project repository
+      - name: Checkout project repository
+        uses: actions/checkout@v4
+        with:
+          path: main_repo
+          token: ${{ secrets.GIT_TOKEN }}
+
+      # Setup Node.js environment
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+
+      # Ensure npm 11.5.1 or later is installed
+      - name: Update npm
+        run: npm install -g npm@latest
+
+      # Install action dependencies
+      - name: Install action dependencies
+        run: npm i --no-package-lock --no-fund --omit=dev
+        working-directory: action_repo/scripts/release
+
+      # Install dependencies
+      - name: Install dependencies
+        run: ${{ inputs.install }}
+
+      # Run Test Only
+      - name: Run Test
+        run: npm test
+        if: inputs.checkTest
+
+      - name: Semantic Release
+        id: release
+        run: node ../action_repo/scripts/release/index.js
+        env:
+          DRYRUN: ${{ inputs.dryRun }}
+
+      - name: Publish ${{ steps.release.outputs.name }}@${{ steps.release.outputs.release_version }}
+        if: steps.release.outputs.release_version && !inputs.dryRun
+        run: |
+          echo ${{ steps.release.outputs.name }}
+          echo ${{ steps.release.outputs.release_version }}
+          echo ${{ steps.release.outputs.registry }}
+          echo ${{ steps.release.outputs.cnpm_sync_url }}