[0xEdouardEth]

Description

Migrates NPM publishing to trusted publishing support via MetaMask/action-npm-publish@v6.

Changes:

• Updates publish workflows to use MetaMask/action-npm-publish@v6.
• Grants id-token: write permission for OIDC-based publishing.
• Makes NPM_TOKEN optional in the reusable publish workflow.
• Bumps packageManager to yarn@4.16.0 and regenerates yarn.lock.

Testing

• Validated modified workflow YAML files parse successfully.
• Ran git diff --check.

---

Note

Medium Risk
Changes the production npm publish path and auth model (OIDC vs long-lived token); misconfiguration could block releases or require one-time NPM_TOKEN setup.

Overview
Switches release publishing to npm trusted publishing by upgrading MetaMask/action-npm-publish from v5 to v6 and enabling OIDC (id-token: write on the caller and publish-npm job).

The reusable publish workflow now treats NPM_TOKEN as optional (only for an initial publish per updated comments); the dry-run step no longer relies on omitting a token comment-wise—it uses the same v6 action. Workflow-level contents: read is added, and packageManager is bumped to yarn@4.16.0 with a regenerated yarn.lock.

^{Reviewed by Cursor Bugbot for commit 84f4560. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Mrtenz]

This needs top-level permissions:

permissions:
  contents: read