feat: Infra sec 0000 npm

.github/workflows/publish.yml

@@ -1,6 +1,14 @@
 name: CI
 
-on: push
+on:
+    push:
+        tags:
+            - 'v*'
+    pull_request:
+
+permissions:
+    id-token: write  # Required for OIDC
+    contents: write  # Required to push lockfile if missing
 
 env:
     CARGO_TERM_COLOR: always
@@ -11,8 +19,8 @@ jobs:
 
         strategy:
             matrix:
-                node-version: [16.x, 15.x, 14.x, 12.x, 10.x]
-                os: [ubuntu-latest, macos-latest]
+                node-version: ['18.x', '22.x']
+                os: [ubuntu-22.04, macos-14]
 
         runs-on: ${{ matrix.os }}
 
@@ -28,11 +36,14 @@ jobs:
               with:
                   node-version: ${{ matrix.node-version }}
 
-            - name: yarn
+            - name: Install
               run: yarn install
 
-            #- name: Test
-            #  run: npm test
+            - name: Build
+              run: yarn build
+
+            - name: Test
+              run: yarn test
 
             #- name: Package
             #  run: yarn package
@@ -48,8 +59,54 @@ jobs:
             # Publish when using '[publish binary]' keywords
             - name: Publish
               env:
-                  NODE_PRE_GYP_GITHUB_TOKEN: ${{ secrets.NODE_PRE_GYP_GITHUB_TOKEN }}
-              if: "contains(github.event.head_commit.message, '[publish binary]')"
+                  NODE_PRE_GYP_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+              if: contains(github.event.head_commit.message, '[publish binary]')
               run: |
                   COMMIT_MESSAGE=$(git log --format=%B --no-merges -n 1 | tr -d '\n') \
                   npm run upload-binary
+
+    publish:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  persist-credentials: true
+                  fetch-depth: 0
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version: '20'
+                  registry-url: 'https://registry.npmjs.org'
+
+            # Ensure npm 11.5.1 or later is installed
+            - name: Update npm
+              run: npm install -g npm@latest
+
+            - name: Install dependencies
+              run: |
+                  if [ -f yarn.lock ]; then
+                    echo "Yarn lockfile present — using yarn"
+                    npm install -g yarn
+                    yarn install --frozen-lockfile
+                  elif [ -f pnpm-lock.yaml ]; then
+                    echo "pnpm lockfile present — using pnpm"
+                    npm install -g pnpm
+                    pnpm install --frozen-lockfile
+                  elif [ -f package-lock.json ]; then
+                    echo "npm lockfile present — running npm ci"
+                    npm ci
+                  else
+                    echo "No lockfile — generating package-lock.json"
+                    npm install --package-lock-only --ignore-scripts
+                    git config user.name "github-actions[bot]"
+                    git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+                    git add package-lock.json
+                    git commit -m "chore: add package-lock.json (generated by CI)" || echo "no changes to commit"
+                    git push origin HEAD:${{ github.ref_name }}
+                    npm ci
+                  fi
+
+            - run: npm run build --if-present
+            - run: npm test
+            - run: npm publish
+              if: startsWith(github.ref, 'refs/tags/v')

.gitignore

@@ -2,8 +2,11 @@ native/target
 build/
 native/index.node
 native/artifacts.json
+target/
 lib/
 **/*~
 **/node_modules
 **/.DS_Store
 bin/
+.env
+.jest-cache/