fix: publish workflow needs idtoken for provenance

.github/workflows/build.yml

@@ -1,6 +1,13 @@
 name: Build
-
-on: push
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
 
 jobs:
   build:

.github/workflows/lint.yml

@@ -1,6 +1,13 @@
 name: Lint
-
-on: push
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
 
 jobs:
   lint:

.github/workflows/publish.yml

@@ -1,12 +1,14 @@
 name: Publish
 on:
-  push:
-    tags:
-      - v*
+  release:
+    types: [created]
 
 jobs:
-  test:
+  publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4

.github/workflows/test.yml

@@ -1,6 +1,13 @@
 name: Test
-
-on: push
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
 
 jobs:
   test: