chore: use trusted publishers (#223)

Author: gastonfournier

.github/workflows/release.yml

@@ -4,6 +4,10 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   build:
 
@@ -30,9 +34,7 @@ jobs:
     - run: |
         LATEST=$(npm show @unleash/proxy version)
         TAG=$(node scripts/npm-tag.js $LATEST)
-        npm publish --tag ${TAG:-latest}
-      env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        npm publish --provenance --tag ${TAG:-latest}
     - name: Mark package as deprecated on npm
       run: |
         VERSION="${GITHUB_REF_NAME#v}"

Dockerfile

@@ -1,20 +1,20 @@
-FROM node:20-alpine as builder
+FROM node:22.22-alpine3.23 AS builder
 
 WORKDIR /unleash-proxy
 
 COPY . .
 
 RUN corepack enable
 
-ENV YARN_ENABLE_SCRIPTS=false
+ENV YARN_ENABLE_SCRIPTS false
 
 RUN yarn install --immutable
 
 RUN yarn build
 
 RUN yarn workspaces focus -A --production
 
-FROM node:20-alpine
+FROM node:22.22-alpine3.23
 
 # Upgrade (addresses OpenSSL CVE-2023-6237 && CVE-2024-2511)
 RUN apk update && \

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unleash/proxy",
-  "version": "1.4.16",
+  "version": "1.4.17",
   "description": "The Unleash Proxy (Open-Source)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",