feat(workflow): migrate npm publishing process to trusted publishing

.github/workflows/npm-publisher.yml

@@ -22,6 +22,10 @@ on:
                 type: string
                 required: true
 
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -40,6 +44,10 @@ jobs:
             node-version: '20.x'
             registry-url: 'https://registry.npmjs.org'
 
+        # Ensure npm 11.5.1 is installed
+        - name: Update npm
+          run: npm install -g [email protected]
+
         - name: Install Protoc
           uses: arduino/setup-protoc@v3
 
@@ -53,10 +61,15 @@ jobs:
             cd ./${{ inputs.project_name }}/types
             npm ci || npm install
             npm run build
-      
+
         - name: Publish to NPM registry
           run: |
             cd ./${{ inputs.project_name }}/types
-            npm publish --provenance --access public
-          env:
-            NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+            # Determine npm tag based on version
+            if [[ "${{ inputs.version }}" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              # Stable release (e.g., 1.7.2 or v1.7.2)
+              npm publish --access public --tag latest
+            else
+              # Pre-release (e.g., 1.7.2-alpha.1 or v1.7.2-alpha.1)
+              npm publish --access public --tag beta
+            fi