automate publishing with provenance (#340)

.github/workflows/release.yml

@@ -9,6 +9,14 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      issues: write
+      repository-projects: write
+      deployments: write
+      packages: write
+      pull-requests: write
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v3
@@ -38,6 +46,9 @@ jobs:
         run: npm ci
 
       - name: Create Release Pull Request
-        uses: changesets/action@master
+        uses: changesets/[email protected]
+        with:
+          publish: npm run changeset publish
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package.json

@@ -149,5 +149,8 @@
 		"hooks": {
 			"pre-commit": "lint-staged"
 		}
+	},
+	"publishConfig": {
+		"provenance": true
 	}
 }