Merge pull request #3016 from modernweb-dev/copilot/update-pipeline-for-publishing

Setup NPM Trusted Publishing

Author: thepassle

.changeset/config.json

@@ -6,5 +6,6 @@
   "ignore": ["@web/dev-server-storybook", "@web/test-runner-integration-tests"],
   "access": "public",
   "baseBranch": "master",
-  "updateInternalDependencies": "patch"
+  "updateInternalDependencies": "patch",
+  "provenance": true
 }

.github/workflows/canary.yml

@@ -13,6 +13,9 @@ jobs:
     if: github.repository == 'modernweb-dev/web'
     name: Pre-release
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4

.github/workflows/release.yml

@@ -12,6 +12,9 @@ jobs:
     if: github.repository == 'modernweb-dev/web'
     name: Release
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4