Update OIDC and node versions (#1355)

- Update release action to use NPM OIDC. This work is modeled on @zibs work in https://github.com/FormidableLabs/victory-native-xl/pull/619/files
    - Note: OIDC connect has been set up in NPM for spectacle, spectacle-mdx-loader, and create-spectacle.
- Update CI to use Node 22.x

Author: ryan-roemer

.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           cache: 'pnpm'
-          node-version: 18.x
+          node-version-file: .nvmrc
 
       # Wireit cache
       - uses: google/wireit@setup-github-actions-caching/v2

.github/workflows/create-spectacle.yml

@@ -21,7 +21,6 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [18.x]
         create-type: ['tsx', 'onepage']
     steps:
       - uses: actions/checkout@v4
@@ -33,7 +32,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           cache: 'pnpm'
-          node-version: ${{ matrix.node-version }}
+          node-version-file: .nvmrc
 
       # Wireit cache
       - uses: google/wireit@setup-github-actions-caching/v2

.github/workflows/release.yml

@@ -8,6 +8,7 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    environment: Production
     permissions:
       contents: write
       id-token: write
@@ -20,6 +21,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
 
       - uses: pnpm/action-setup@v3
@@ -29,7 +31,10 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           cache: 'pnpm'
-          node-version: 18.x
+          node-version-file: .nvmrc
+
+      - name: Upgrade npm for OIDC
+        run: npm i -g npm@>=11.5.1
 
       - name: Install dependencies
         run: pnpm install
@@ -48,4 +53,3 @@ jobs:
           publish: pnpm changeset publish
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.nvmrc

@@ -1 +1 @@
-18.x
+22.x