fix release script, use OIDC (#5713)

tools/publish

@@ -1,4 +1,5 @@
 #!/bin/bash
+set -e
 
 cd "$(dirname "$0")"
 cd '..'
@@ -40,17 +41,18 @@ else
   exit 1
 fi
 
-if [ -f ~/.npmrc ]; then
-  echo "Found existing .npmrc"
+# Note: When running in GitHub Actions with trusted publishing (OIDC),
+# npm whoami won't work as OIDC auth only applies during npm publish.
+# For local publishing, ensure you're logged in with 'npm login'.
+if [[ -z "$CI" ]] && ! npm whoami &> /dev/null; then
+  echo "Not authenticated with npm. Run 'npm login' to authenticate."
+  exit 1
+fi
+if [[ -z "$CI" ]]; then
+  echo "Publishing as NPM user: $(npm whoami)"
 else
-  if [[ -z "$NPM_TOKEN" ]];then
-    echo "No NPM_TOKEN or ~/.npmrc, exiting.."
-    exit 1;
-  else
-    echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-  fi
+  echo "Publishing via GitHub Actions OIDC trusted publishing"
 fi
-echo "Publishing as NPM user: `npm whoami`"
 
 if [[ $BRANCH != 'main' ]]; then
   echo "Not on 'main' branch.  Exiting"
@@ -66,9 +68,12 @@ echo ""
 echo "-----> BUMP VERSION"
 echo ""
 
-npm version $VERSION_ARGS || exit 1
+npm version $VERSION_ARGS
 
-git push && git push --tags || exit 1
+git push && git push --tags
+
+NEW_VERSION=$(cat package.json | jq -r .version)
+echo "New Version: $NEW_VERSION"
 
 npm install
 
@@ -78,10 +83,7 @@ git add .
 
 git commit -am "chore(${NEW_VERSION}): generate docs"
 
-git push 
-
-NEW_VERSION=`cat package.json | jq -r .version`
-echo "New Version: $NEW_VERSION"
+git push
 
 echo ""
 echo "-----> PUSH TO NPM"
@@ -95,7 +97,5 @@ echo "-----> Done!"
 echo "Version $NEW_VERSION published to $DIST_TAG tag"
 echo ""
 
-echo "::set-output name=NEW_VERSION::$NEW_VERSION"
-echo "::set-output name=PRERELEASE::$PRERELEASE"
-
-exit 0
+echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_OUTPUT
+echo "PRERELEASE=$PRERELEASE" >> $GITHUB_OUTPUT