ci: migrate npm publish to OIDC trusted publishing

.github/workflows/publish.yaml

@@ -1,63 +1,28 @@
-name: 'Publish packages'
+name: Publish NPM Package
 
 on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
   release:
-    types:
-      - published
-      - edited
-    tags:
-      - "v[0-9]+(\\.[0-9]+)*"
+    types: [created]
 
-jobs:
-  configure:
-    runs-on: zondax-runners
-    outputs:
-      datetime: ${{ steps.get-datetime.outputs.datetime }}
-    steps:
-      - id: get-datetime
-        run: echo "datetime=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_OUTPUT
-
-  publish_npm_package:
-    runs-on: zondax-runners
-    container:
-      image: node:20-bookworm
-      env:
-        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        HEAD_BRANCH_NAME: ${{ github.head_ref }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: true
-
-      - name: Install node
-        uses: actions/setup-node@v4
-        with:
-          registry-url: 'https://registry.npmjs.org'
-          scope: '@zondax'
-
-      - uses: oven-sh/setup-bun@v2
-
-      - run: bun install
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 
-      - run: bun run build
+permissions:
+  contents: read
+  id-token: write
 
-      - name: Get latest release version number
-        id: get_version
-        uses: battila7/get-version-action@v2
-
-      - name: Show version
-        run: echo ${{ steps.get_version.outputs.version }}
-
-      - name: Update tag
-        run: |
-          npm --allow-same-version --no-git-tag-version version ${{ steps.get_version.outputs.version }}
-
-      - name: Publish package
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_PUBLISH_AUTO }}
-          NODE_REPO_SERVER: 'https://registry.npmjs.org'
-        run: |
-          npm config set registry $NODE_REPO_SERVER
-          npm config set //registry.npmjs.org/:_authToken $NODE_AUTH_TOKEN
-          npm publish
+jobs:
+  publish-npm:
+    uses: zondax/_workflows/.github/workflows/_publish-npm.yaml@v7
+    permissions:
+      contents: read
+      id-token: write # Required for OIDC trusted publishing - must be in caller!
+    with:
+      timeout_minutes: 15
+      dry_run: ${{ github.event_name != 'release' }}
+      github_app_auth: false

.mise.toml

@@ -0,0 +1,13 @@
+[tools]
+node = "22"
+bun = "latest"
+
+[tasks.ci_postinstall]
+description = "Install dependencies for CI"
+# Non-frozen: bun.lockb has pre-existing drift vs package.json and the CI bun
+# version can differ from local, so --frozen-lockfile would fail the build.
+run = "bun install"
+
+[tasks.ci_detect_pm]
+description = "Run package scripts with bun (avoids the 'bun build' bundler)"
+run = "echo 'pm=bun run'"

package.json

@@ -38,13 +38,13 @@
     "glob": "^11.0.0"
   },
   "dependencies": {
-    "@ledgerhq/hw-transport": "6.31.9"
+    "@ledgerhq/hw-transport": "6.35.4"
   },
   "devDependencies": {
     "@ledgerhq/hw-transport-mocker": "^6.29.9",
     "@trivago/prettier-plugin-sort-imports": "^5.2.2",
     "@types/jest": "30.0.0",
-    "@types/node": "^24.3.0",
+    "@types/node": "^25.9.3",
     "@typescript-eslint/eslint-plugin": "^8.40.0",
     "@typescript-eslint/parser": "^8.40.0",
     "eslint": "^9.33.0",