[release:patch] 2.15.7 Use trusted publishing

Author: EagleoutIce

.github/workflows/release.yaml

@@ -113,6 +113,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 75
     needs: ['test-full']
+    permissions:
+      contents: read
+      id-token: write
     concurrency:
       group: release-main
       cancel-in-progress: false
@@ -202,12 +205,13 @@ jobs:
         # we use publish-library because flowr itself is a runnable, and we do not want to publish something with extra
         # dist paths etc.
         # besides, we make dead-sure we have a clean directory to work on!
+        # uses npm trusted publishing (OIDC): no token, package.json's Trusted Publisher config on npmjs.com must
+        # match this repo/workflow/environment, and npm needs to be new enough to speak OIDC.
         run: |
+          npm install -g npm@latest
           rm -rf dist
           npm run build
           npm run publish-library
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
     outputs:
       version: ${{ steps.release.outputs.version }}