Migrate to Trusted Publishing

[pcaversaccio]

Background: https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/

You rely on NPM_TOKENs e.g. here which will be revoked (I assume it's a legacy token):

openzeppelin-contracts/.github/workflows/release-cycle.yml

Line 154 in 1cf1377

NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

You should migrate to trusted publishing: https://docs.npmjs.com/trusted-publishers. Note that trusted publishing will automatically generate provenance: https://docs.npmjs.com/trusted-publishers#automatic-provenance-generation.

[ernestognw]

Hi @pcaversaccio! Thanks for prompting us to change our method of publishing.
I just configured the trusted publisher for the library on NPM and opened a PR to remove the token from the CI
#6009

It'll take a bit since I'll need someone else's review