fix(ci): publish to npm with provenance (#528)

See npm docs https://docs.npmjs.com/generating-provenance-statements

See semantic-release docs
https://github.com/semantic-release/npm/blob/master/README.md#npm-provenance

Author: styfle

.github/workflows/ci.yml

@@ -24,6 +24,11 @@ jobs:
         os: [ubuntu-latest, macos-14, windows-latest]
         node: [18, 20]
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
     services:
       redis:
         # See workaround https://github.com/actions/runner/issues/822#issuecomment-1524826092
@@ -54,8 +59,9 @@ jobs:
           BULL_REDIS_CONNECTION: ${{ (matrix.os == 'ubuntu-latest') && 'redis://127.0.0.1:6379/0' || '' }}
         run: npm run ${{ (matrix.os == 'ubuntu-latest') && 'test-verbose' || 'test' }}
       - name: Maybe Release
-        if: matrix.os == 'ubuntu-latest' && matrix.node == 18 && github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: matrix.os == 'ubuntu-latest' && matrix.node == 20 && github.event_name == 'push' && github.ref == 'refs/heads/main'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN_ELEVATED }}
-        run: npx [email protected]
+          NPM_CONFIG_PROVENANCE: 'true'
+        run: npx [email protected]