Merge pull request #50 from grafana/academo/use-vault-output

Chore: Use get-vault-secrets without exporting env variables

Author: academo

.github/workflows/publish-npm.yml

@@ -14,10 +14,11 @@ jobs:
       packages: write
     steps:
       - id: get-secrets
-        uses: grafana/shared-workflows/actions/get-vault-secrets@28361cdb22223e5f1e34358c86c20908e7248760 # get-vault-secrets-v1.1.0
+        uses: grafana/shared-workflows/actions/get-vault-secrets@get-vault-secrets/v1.2.1 # zizmor: ignore[unpinned-uses] provided by grafana
         with:
           repo_secrets: |
             NPM_TOKEN=npm_token:npm_token
+          export_env: false
 
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -56,4 +57,4 @@ jobs:
         if: steps.version_check.outputs.changed == 'true'
         run: npm publish --access public
         env:
-          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ fromJSON(steps.get-secrets.outputs.secrets).NPM_TOKEN }}