Add trusted publishing for npm package (#329)

Author: colinrotherham

.github/workflows/release.yml

@@ -8,6 +8,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
 
+    permissions:
+      id-token: write
+
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -39,11 +42,7 @@ jobs:
       - name: Publish npm package
         if: ${{ !github.event.release.prerelease }}
         run: npm publish --tag latest
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish npm package (pre-release)
         if: ${{ github.event.release.prerelease }}
         run: npm publish --tag beta
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

README.md

@@ -62,8 +62,6 @@ Releases run in CI using github actions.
 
 To prepare a release create a new release TAG in github with your release version.
 
-> `NPM_TOKEN` should be stored in the repositories [secrets in GitHub](https://github.com/NHSDigital/nhsuk-react-components/settings/secrets/actions)
-
 - Create a new release with a tag like `major.minor.patch` against main.
 - If the change is a `beta` then select `pre-release` as true, this will make the `tag` point at `beta`. Otherwise the tag will be `latest`.