Update release workflow to support npm trusted publshing (#25)

Author: nex3

.github/workflows/ci.yml

@@ -50,19 +50,11 @@ jobs:
     runs-on: ubuntu-latest
     if: "startsWith(github.ref, 'refs/tags/') && github.repository == 'sass/sync-message-port'"
     needs: [static_analysis, tests]
-
-    steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 'lts/*'
-          check-latest: true
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm install
-      - run: npm run compile
-      - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+    uses: ./.github/workflows/release.yml
 
   typedoc:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -0,0 +1,26 @@
+name: Release
+
+on:
+  workflow_call:
+
+jobs:
+  deploy:
+    name: Deploy
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 'lts/*'
+          check-latest: true
+          registry-url: 'https://registry.npmjs.org'
+
+      # npm trusted publisher infrastructure requires npm >=11.5.1
+      - run: npm install -g npm@latest
+
+      - run: npm install
+      - run: npm run compile
+      - run: npm publish
+        env:
+          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'