Add support for NPM trusted publishing

.github/workflows/publish.yml

@@ -2,10 +2,16 @@ name: Publish & Release SDK
 on:
   workflow_dispatch:
     inputs:
-      cab_id:
-        description: "CAB id for the change/release"
+      orr_id:
+        description: "ORR id for the change/release"
         required: true
         type: string
+        default: ORR-8317
+      dry_run:
+        description: "Run the publish step in dry-run"
+        required: true
+        type: boolean
+        default: false
 
 jobs:
   publish:
@@ -14,6 +20,7 @@ jobs:
     outputs:
       release_number: ${{steps.get_latest_release_number.outputs.release_tag}}
     permissions:
+      id-token: write
       contents: write
       pull-requests: write
     steps:
@@ -24,7 +31,7 @@ jobs:
           path: xero-node
 
       - name: Set up Node environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: 'npm'
@@ -52,7 +59,7 @@ jobs:
       - name: Publish to npm
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npm publish
+        run: npm publish ${{ inputs.dry_run && '--dry-run' || '' }}
         working-directory: xero-node
 
   notify-codegen-repo:
@@ -102,7 +109,7 @@ jobs:
                   "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                   "environment": "prod",
                   "sdk_type": "node",
-                  "cab_key": "${{ github.event.inputs.cab_id }}"
+                  "cab_key": "${{ github.event.inputs.orr_id }}"
                   }
                 }'