Can someone tell me what am I doing wrong? The whole point of trusted publishing is so I DON'T have to log in to npm to publish a package from a trusted workflow. So no tokens are involved.