Adopt the shared release workflow with Trusted Publishing

.github/workflows/main.yml

@@ -17,7 +17,6 @@ env:
   # Among other things, opts out of Turborepo telemetry. See https://consoledonottrack.com/.
   DO_NOT_TRACK: '1'
   NODE_VERSION: 24
-  RELEASE_VERSION: 1.x
 
 jobs:
   lint:
@@ -77,51 +76,16 @@ jobs:
 
   release:
     name: Release
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push'
     needs: [lint, tests]
+    if: github.event_name == 'push'
     permissions:
       contents: write
       pull-requests: write
-    outputs:
-      published: ${{ steps.changesets.outputs.published }}
-    steps:
-      - name: Create GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@v3
-        with:
-          client-id: ${{ secrets.RELEASE_APP_CLIENT_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: pnpm
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Create Release Pull Request or Publish
-        id: changesets
-        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
-        with:
-          github-token: ${{ steps.app-token.outputs.token }}
-          version-script: pnpm release:version
-          commit-message: '[${{ env.RELEASE_VERSION }}] Publish packages'
-          pr-title: '[${{ env.RELEASE_VERSION }}] Publish packages'
-          publish-script: pnpm publish-packages
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      id-token: write
+    uses: codama-idl/release-tools/.github/workflows/release.yml@v1
+    with:
+      release-version: 1.x
+    secrets: inherit
 
   dependabot:
     name: Dependabot

package.json

@@ -7,13 +7,13 @@
         "lint": "oxlint && oxfmt --check",
         "lint:fix": "oxlint --fix && oxfmt",
         "test": "turbo run test --log-order grouped",
-        "publish-packages": "pnpm build && changeset publish",
+        "release:publish": "pnpm build && changeset publish",
         "release:version": "changeset version && release-tools postversion"
     },
     "devDependencies": {
         "@changesets/changelog-github": "^1.0.1",
         "@changesets/cli": "^3.0.2",
-        "@codama/release-tools": "github:codama-idl/release-tools#v1.2.0",
+        "@codama/release-tools": "github:codama-idl/release-tools#v1.3.1",
         "@solana-config/oxc": "^0.1.1",
         "@types/node": "^26",
         "agadoo": "^3.0.0",