From d60a0651acd810e39d24b8865244c741282114da Mon Sep 17 00:00:00 2001 From: Jean Burellier Date: Tue, 16 Dec 2025 18:07:33 +0100 Subject: [PATCH 1/2] chore(ci): npm-publish via staged publish --- .github/workflows/npm-publish.yml | 89 +++++++++++++++++++++++++++++++ .npmrc | 7 +++ package.json | 3 ++ 3 files changed, 99 insertions(+) create mode 100644 .github/workflows/npm-publish.yml create mode 100644 .npmrc diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml new file mode 100644 index 0000000..ce9860e --- /dev/null +++ b/.github/workflows/npm-publish.yml @@ -0,0 +1,89 @@ +name: Publish package to npm + +on: + release: + types: [created] + +concurrency: + group: "${{ github.workflow }} ✨ ${{ github.ref }}" + cancel-in-progress: false + +permissions: + contents: read + +jobs: + audit: + name: Audit production dependencies + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Setup Node.js + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: "lts/*" + + - name: Audit production dependencies + run: npm audit --omit=dev + + lint: + name: Lint + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Setup Node.js + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: "lts/*" + + - name: Install dependencies + run: npm install --ignore-scripts --include=dev + + - name: Run lint + run: node --run lint + + test: + name: Test + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Setup Node.js + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: "lts/*" + + - name: Run tests + run: npm test + + publish: + name: Publish to npm + needs: [audit, lint, test] + runs-on: ubuntu-latest + permissions: + contents: read + id-token: write + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Setup Node.js + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: "lts/*" + registry-url: "https://registry.npmjs.org" + + # npm stage publish requires npm >= 11.15.0 + - name: Upgrade npm + run: npm install -g npm@latest + + - name: Stage publish to npm + run: npm stage publish diff --git a/.npmrc b/.npmrc new file mode 100644 index 0000000..c1e4cca --- /dev/null +++ b/.npmrc @@ -0,0 +1,7 @@ +allow-file=none +allow-remote=none +allow-git=none +allow-directory=none + +min-release-age=7 +save-exact=false \ No newline at end of file diff --git a/package.json b/package.json index 5f60e5f..3ad7ee6 100644 --- a/package.json +++ b/package.json @@ -29,6 +29,9 @@ "README.md", "index.js" ], + "publishConfig": { + "provenance": true + }, "engines": { "node": ">= 0.8.0" }, From 60210bcf204f0be965cf5b7aaab6bb8490fa86a7 Mon Sep 17 00:00:00 2001 From: Jean Burellier Date: Sun, 2 Aug 2026 16:55:16 +0200 Subject: [PATCH 2/2] chore(ci): bump actions/checkout and setup-node to latest in npm-publish --- .github/workflows/npm-publish.yml | 56 ++----------------------------- 1 file changed, 2 insertions(+), 54 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index ce9860e..eb69f9d 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -12,71 +12,19 @@ permissions: contents: read jobs: - audit: - name: Audit production dependencies - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false - - - name: Setup Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - with: - node-version: "lts/*" - - - name: Audit production dependencies - run: npm audit --omit=dev - - lint: - name: Lint - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false - - - name: Setup Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - with: - node-version: "lts/*" - - - name: Install dependencies - run: npm install --ignore-scripts --include=dev - - - name: Run lint - run: node --run lint - - test: - name: Test - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false - - - name: Setup Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - with: - node-version: "lts/*" - - - name: Run tests - run: npm test - publish: name: Publish to npm - needs: [audit, lint, test] runs-on: ubuntu-latest permissions: contents: read id-token: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "lts/*" registry-url: "https://registry.npmjs.org"