Merge pull request #271 from Gigadrive/feature/oidc-npm-publish

chore: enable npm trusted publishing

Author: Zeryther

.github/actions/setup/action.yaml

@@ -6,6 +6,10 @@ inputs:
     description: Node.js version to use
     required: false
     default: '22'
+  registry-url:
+    description: Registry URL for npm
+    required: false
+    default: ''
 
 runs:
   using: composite
@@ -14,9 +18,10 @@ runs:
       uses: pnpm/action-setup@v4
 
     - name: Setup Node.js
-      uses: useblacksmith/setup-node@v5
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ inputs.node-version }}
+        registry-url: ${{ inputs.registry-url }}
         cache: pnpm
 
     - name: Install dependencies

.github/workflows/release.yaml

@@ -20,7 +20,7 @@ env:
 jobs:
   release:
     name: Release
-    runs-on: blacksmith-4vcpu-ubuntu-2204
+    runs-on: ubuntu-latest
     timeout-minutes: 20
 
     permissions:
@@ -39,6 +39,11 @@ jobs:
 
       - name: Setup
         uses: ./.github/actions/setup
+        with:
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Upgrade npm (OIDC trusted publishing)
+        run: npm install -g npm@11.5.1
 
       - name: Build
         run: pnpm build
@@ -52,7 +57,6 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_CONFIG_PROVENANCE: 'true'
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Set latest Release to `gigadrive`
         if: steps.changesets.outputs.published == 'true'

package.json

@@ -12,7 +12,7 @@
   "scripts": {
     "build": "turbo run build",
     "build:no-cache": "turbo run build --force",
-    "ci:publish": "pnpm publish -r && node scripts/update-canary-tags.mjs && changeset tag",
+    "ci:publish": "npm publish --workspace=@gigadrive/sdk --workspace=@gigadrive/commons --workspace=@gigadrive/network-config --workspace=@gigadrive/build-utils --workspace=@gigadrive/harmony --workspace=gigadrive && node scripts/update-canary-tags.mjs && changeset tag",
     "ci:version": "changeset version && pnpm install --no-frozen-lockfile",
     "clean": "turbo run clean",
     "dev": "turbo run dev",