Trusted Publishing

.github/workflows/ci.yml

@@ -1,59 +1,19 @@
 name: CI
 
 on:
-  workflow_dispatch:
   pull_request:
   push:
 
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version-file: 'package.json'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Lint
-        run: npm run lint:ci
-
-  type-check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: 'package.json'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build
-        run: npm run build
-
-      - name: Type Check
-        run: npm run type-check
-
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22.18.0'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Test
-        run: npm run test:ci
+      - run: npm ci
+      - run: npm run lint:ci
+      - run: npm run type-check
+      - run: npm run build
+      - run: npm run test:ci

.github/workflows/coverage.yml

@@ -12,15 +12,11 @@ jobs:
   coverage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
-          node-version: '22.18.0'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
+          node-version-file: 'package.json'
+      - run: npm ci
 
       - name: Get Coverage
         id: get-coverage
@@ -31,7 +27,7 @@ jobs:
           echo "coverage=$COV" >> $GITHUB_OUTPUT
 
       - name: Checkout assets
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: 'assets'
 

.github/workflows/github-pages.yml

@@ -16,11 +16,10 @@ jobs:
     concurrency: gh-${{ github.ref }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: 'package.json'
-          cache: 'npm'
 
       - name: Install dependencies
         working-directory: docs/

.github/workflows/release.yml

@@ -13,12 +13,17 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for trusted publishing and npm provenance
+
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
-          node-version: '22.18.0'
-          cache: 'npm'
+          node-version-file: 'package.json'
 
       - run: npm ci
       - run: npm test
@@ -27,5 +32,4 @@ jobs:
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npx semantic-release