From 8a2f9026ff7e3e6da54326588607cb4f469809fc Mon Sep 17 00:00:00 2001
From: Anthony Fu <github@antfu.me>
Date: Tue, 23 Sep 2025 09:03:39 +0900
Subject: [PATCH] feat: prompt trusted publisher

---
 .github/workflows/release.yml | 32 ++++++--------------------------
 README.md                     |  8 ++++++++
 package.json                  |  2 +-
 3 files changed, 15 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 07ad363..6877b39 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,9 +1,5 @@
 name: Release
 
-permissions:
-  id-token: write
-  contents: write
-
 on:
   push:
     tags:
@@ -11,25 +7,9 @@ on:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
-          registry-url: https://registry.npmjs.org/
-
-      - run: pnpm dlx changelogithub
-        env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-
-      # # Uncomment the following lines to publish to npm on CI
-      #
-      # - run: pnpm install
-      # - run: pnpm publish --no-git-checks -r --access public
-      #   env:
-      #     NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-      #     NPM_CONFIG_PROVENANCE: true
+    uses: sxzz/workflows/.github/workflows/release.yml@v1
+    with:
+      publish: true
+    permissions:
+      contents: write
+      id-token: write
diff --git a/README.md b/README.md
index 35eb177..68336ed 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,14 @@
 
 _description_
 
+## Note for Developers
+
+This starter recommands using [npm Trusted Publisher](https://github.com/e18e/ecosystem-issues/issues/201), where the release is done on CI to ensure the security of the packages.
+
+To do so, you need to run `pnpm publish` manually for the very first time to create the package on npm, and then go to `https://www.npmjs.com/package/<your-package-name>/access` to set the connection to your GitHub repo.
+
+Then for the future releases, you can run `pnpm run release` to do the release and the GitHub Actions will take care of the release process.
+
 ## Sponsors
 
 <p align="center">
diff --git a/package.json b/package.json
index 3278d68..98e7ac9 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "dev": "unbuild --stub",
     "lint": "eslint",
     "prepublishOnly": "nr build",
-    "release": "bumpp && pnpm publish",
+    "release": "bumpp",
     "start": "tsx src/index.ts",
     "test": "vitest",
     "typecheck": "tsc --noEmit",