feat: switch to publish packages using trusted publishers instead of tokens

.github/workflows/deploy-storybook.yml

@@ -10,6 +10,7 @@ concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 permissions:
   pages: write # to deploy to Pages
+  contents: read
   id-token: write
 
 jobs:
@@ -23,10 +24,20 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
 
     steps:
-      - name: Setup workspace
-        uses: plexinc/react-lightning/.github/actions/setup@main
+      - uses: actions/checkout@v4
         with:
-          npm-token: ${{ secrets.NPM_TOKEN }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: package.json
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
 
       - name: Build Storybook
         run: pnpm run build:storybook

.github/workflows/release-packages.yml

@@ -11,6 +11,7 @@ on:
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 permissions:
+  contents: read
   id-token: write
 
 jobs:
@@ -23,10 +24,21 @@ jobs:
       published: ${{ steps.changesets.outputs.published }}
 
     steps:
-      - name: Setup workspace
-        uses: plexinc/react-lightning/.github/actions/setup@main
+      - uses: actions/checkout@v4
         with:
-          npm-token: ${{ secrets.NPM_TOKEN }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: package.json
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+        shell: bash
 
       - name: Create release pull request or publish
         id: changesets