chore: add OIDC authentication for npm in release workflow

.github/workflows/ci.yml

@@ -7,9 +7,6 @@ on:
     branches:
       - main
 
-env:
-  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-
 jobs:
   block-autosquash:
     if: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == false }}
@@ -25,31 +22,27 @@ jobs:
     if: github.event.pull_request.draft == false
     name: build
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [20.x]
 
     steps:
       - uses: actions/checkout@v4
-      - name: Enable Corepack
-        run: corepack enable
+
       - uses: actions/setup-node@v4
         with:
-          node-version: ${{ matrix.node-version }}
-          cache: 'npm'
+          node-version-file: '.nvmrc'
 
       - uses: actions/cache@v4
         id: npm-cache
         with:
           path: '**/node_modules'
-          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json', '.nvmrc') }}
 
       - uses: actions/cache@v4
         with:
           path: '**/build'
           key: ${{ runner.os }}-build-${{ github.sha }}
 
       - name: Install dependencies
+        if: steps.npm-cache.outputs.cache-hit != 'true'
         run: npm ci --ignore-scripts
 
       - name: Build artifacts
@@ -59,35 +52,24 @@ jobs:
     name: test:unit
     needs: build
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [20.x]
 
     steps:
       - uses: actions/checkout@v4
-      - name: Enable Corepack
-        run: corepack enable
+
       - uses: actions/setup-node@v4
         with:
-          node-version: ${{ matrix.node-version }}
-          cache: 'npm'
+          node-version-file: '.nvmrc'
 
       - uses: actions/cache@v4
         id: npm-cache
         with:
           path: '**/node_modules'
-          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json', '.nvmrc') }}
 
       - uses: actions/cache@v4
         with:
           path: '**/build'
           key: ${{ runner.os }}-build-${{ github.sha }}
 
-      - name: Install
-        run: npm ci --ignore-scripts
-
-      - name: Build artifacts
-        run: npm run build
-
       - name: Run tests
         run: npm run test

.github/workflows/release.yml

@@ -5,7 +5,9 @@ on:
     branches:
       - main
 
-concurrency: ${{ github.workflow}}-${{github.ref}}
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
 
 jobs:
   release:
@@ -18,32 +20,23 @@ jobs:
           # This makes action fetch all Git history so that Changesets can generate changelogs with the correct commits
           fetch-depth: 0
 
-      - name: Enable Corepack
-        run: corepack enable
-
-      - name: Use Node.js 20.x
+      - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20.x
-          cache: 'npm'
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          node-version-file: '.nvmrc'
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: npm ci --ignore-scripts
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Build the release
         run: npm run build
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create Release Pull Request or Publish to npm
         uses: changesets/action@v1
         with:
           version: npm run changeset version
           publish: npm run release
+          commit: 'chore: version packages'
         env:
           GITHUB_TOKEN: ${{ secrets.CHANGESET_RELEASE_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.husky/commit-msg

@@ -1,4 +1 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
 npx --no -- commitlint --edit ${1}

.nvmrc

@@ -1 +1 @@
-20.13.0
+24