@@ -4,7 +4,7 @@ name: Make Release
44#
55# === Automated activities ===
66# 1. [Quality check] run unit tests and linting
7- # 2. [Release] publish package to npmjs.org using the latest git commit, ensure provenance with NPM_CONFIG_PROVENANCE=true
7+ # 2. [Release] publish package to npmjs.org using OIDC authentication with automatic provenance attestations
88# 3. [Create tag] create a new git tag using released version, i.e. v1.13.1
99#
1010# === Manual activities ===
@@ -28,12 +28,12 @@ jobs:
2828 run-e2e-tests :
2929 uses : ./.github/workflows/reusable-e2e.yml
3030 # This job publishes the packages to npm.
31- # It uses the latest git commit sha as the version and ensures provenance with NPM_CONFIG_PROVENANCE flag .
31+ # It uses OIDC authentication with automatic provenance attestations .
3232 # We don't bump the version because we do that in the `make-version` workflow.
3333 # It also sets the RELEASE_VERSION output to be used by the next job to create a git tag.
3434 publish-npm :
3535 needs : [run-e2e-tests, run-unit-tests]
36- # Needed as recommended by npm docs on publishing with provenance https://docs.npmjs.com/generating-provenance-statements
36+ # Needed for OIDC authentication with npm trusted publishing
3737 permissions :
3838 id-token : write
3939 environment : Release
@@ -46,18 +46,14 @@ jobs:
4646 with :
4747 ref : ${{ github.sha }}
4848 - name : Setup Node.js
49- uses : actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6 .0.0
49+ uses : actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 .0.0
5050 with :
5151 node-version : " 22"
5252 cache : " npm"
53- - name : Setup auth tokens
54- run : |
55- npm set "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}"
5653 - name : Setup dependencies
5754 uses : aws-powertools/actions/.github/actions/cached-node-modules@3b5b8e2e58b7af07994be982e83584a94e8c76c5
5855 - name : Publish to npm
59- run : |
60- NPM_CONFIG_PROVENANCE=true npm publish
56+ run : npm publish
6157 - name : Set release version
6258 id : set-release-version
6359 run : |
0 commit comments