ci: remove permissions from CI workflow and ensure OIDC is set in publish workflow

Author: zachowj

.github/workflows/ci.yml

@@ -14,10 +14,6 @@ on:
       - ".npmignore"
       - "package*.json"
 
-permissions:
-  id-token: write # Required for OIDC
-  contents: read
-
 concurrency:
   group: ci-${{ github.head_ref }}
   cancel-in-progress: true

.github/workflows/publish.yml

@@ -4,6 +4,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  id-token: write # Required for OIDC
   contents: read
 
 jobs:
@@ -23,5 +24,3 @@ jobs:
         run: pnpm install && pnpm run build
       - name: Publish package on NPM
         run: pnpm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}