fix(publish): add --access public and provenance attestation

Author: stooit

.github/workflows/publish.yml

@@ -8,6 +8,8 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # required for npm provenance attestation
 
     steps:
       - name: Checkout code
@@ -29,6 +31,6 @@ jobs:
         run: npm test --if-present
 
       - name: Publish to NPM
-        run: npm publish
+        run: npm publish --access public --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}