Update release workflow to use trusted publishing

[risantos]

Description

• Updates the release workflow to use OIDC publishing via release-it. See https://github.com/release-it/release-it/blob/3378faf75f1a8e2e87f63a4914f8df68223b3a5b/docs/npm.md#trusted-publishing-oidc

[Copilot]

Pull request overview

This PR updates the release workflow to use OIDC-based trusted publishing for npm, replacing traditional token-based authentication. It also upgrades the release-it tool and several GitHub Actions to newer versions.

Changes:

• Adds OIDC permissions (id-token: write) and removes manual npm token configuration
• Updates release-it from v19.0.3 to v19.2.3 with skipChecks: true configuration
• Upgrades GitHub Actions and Node.js versions used in the release workflow

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/release.yaml	Adds OIDC permissions, removes npm token configuration, updates action versions to v6, and changes Node.js version to 24
.release-it.js	Adds skipChecks: true to npm configuration for trusted publishing
package.json	Updates release-it dependency version and reorders dependency list alphabetically
yarn.lock	Updates lockfile with new dependency versions for release-it and its transitive dependencies

Comments suppressed due to low confidence (1)

.github/workflows/release.yaml:50

• The removal of npm authentication configuration suggests a transition to OIDC trusted publishing, which relies on the id-token: write permission instead of npm tokens. However, the PR description or code comments do not explain how the npm registry needs to be configured on the npm side to accept OIDC tokens from this GitHub Actions workflow. Ensure that the npm package has trusted publishing configured for this GitHub repository before merging.

    - name: Generate release
      env:
        GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
      run: npm run release -- --increment "${{ github.event.inputs.VERSION_BUMP }}" -V

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The skipChecks option is set to true without documentation explaining why this is necessary for OIDC publishing. This bypasses important pre-publish validations. Consider documenting the reason for this change in a comment, or verify if this option is actually required for trusted publishing to work.

Suggested change

	publish: true,
	publish: true,
	// NOTE: `skipChecks` is intentionally enabled because npm's local credential
	// and 2FA checks are incompatible with our CI-based OIDC/trusted publishing
	// workflow. Release validation and authorization are enforced by the
	// GitHub Actions pipeline rather than via `npm publish` pre-checks.

[Copilot]

The Node.js version has been upgraded from 22 to 24. Note that Node.js 24 is currently in active development and may not be a stable LTS release. Verify that all project dependencies and build tools are compatible with Node.js 24, or consider using Node.js 22 (the current LTS) if Node.js 24 compatibility is not required.

Suggested change

	node-version: 24
	node-version: 22