fix: npm trusted publishing

.github/workflows/publish.yml

@@ -5,23 +5,20 @@ on:
     tags:
     - 'v*'
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   npm:
     name: Publish to NPM
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+    - uses: actions/checkout@v6
+    - uses: actions/setup-node@v6
       with:
-        node-version: 20
-        registry-url: https://registry.npmjs.org/
-    - uses: pnpm/action-setup@v4
-      with:
-        run_install: false
-    - run: pnpm install --frozen-lockfile
-    - run: pnpm publish --no-git-checks
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        NPM_CONFIG_PROVENANCE: true
+        node-version: "24"
+        registry-url: "https://registry.npmjs.org"
+    - run: npm install -g npm@latest
+    - run: npm ci
+    - run: npm publish

.github/workflows/test.yml

@@ -16,27 +16,24 @@ jobs:
         - macos-latest
         - windows-latest
         node:
+        - 24
         - 22
         - 20
-        - 18
       fail-fast: false
     runs-on: ${{ matrix.os }}
     name: Node ${{ matrix.node }} on ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+    - uses: actions/checkout@v6
+    - uses: actions/setup-node@v6
       with:
         node-version: ${{ matrix.node }}
-    - uses: pnpm/action-setup@v4
-      with:
-        run_install: false
-    - run: pnpm install --frozen-lockfile
+    - run: npm ci
       env:
         DEBUG: careful-downloader
         DEBUG_HIDE_DATE: 1
         DEBUG_COLORS: 0
-    - run: pnpm audit --prod
+    - run: npm audit --omit=dev
       continue-on-error: true
-    - run: pnpm run test
+    - run: npm run test
     - run: node lib/cli.js new site mysite
     - run: node lib/cli.js --source mysite/ --minify --enableGitInfo --logLevel info