fix(ci): bypass semantic-release npm publish for trusted publisher

Author: KengoTODA

.github/workflows/build.yml

@@ -49,7 +49,6 @@ jobs:
           pnpm run semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ env.NODE_AUTH_TOKEN }}
   sbom:
     runs-on: ubuntu-latest
     permissions:

package.json

@@ -38,6 +38,7 @@
     "@jest/transform": "29.7.0",
     "@jest/types": "29.6.3",
     "@semantic-release/changelog": "6.0.3",
+    "@semantic-release/exec": "7.1.0",
     "@semantic-release/git": "10.0.1",
     "@semantic-release/npm": "13.1.3",
     "@types/signale": "1.4.7",
@@ -71,11 +72,18 @@
         "path": "@semantic-release/changelog",
         "changelogFile": "CHANGELOG.md"
       },
-      "@semantic-release/npm",
+      {
+        "path": "@semantic-release/npm",
+        "npmPublish": false,
+        "tarballDir": "dist"
+      },
       "@semantic-release/git"
     ],
     "publish": [
-      "@semantic-release/npm",
+      {
+        "path": "@semantic-release/exec",
+        "publishCmd": "npm publish ./dist/*.tgz"
+      },
       "@semantic-release/github"
     ],
     "generateNotes": [