Fix Release Plan

.github/workflows/plan-release.yml

@@ -4,9 +4,10 @@ on:
     branches:
       - main
       - master
-  pull_request:
+  pull_request_target: # This workflow has permissions on the repo, do NOT run code from PRs in this workflow. See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
     types:
       - labeled
+      - unlabeled
 
 concurrency:
   group: plan-release # only the latest one of these should ever be running
@@ -36,12 +37,13 @@ jobs:
     needs: check-plan
     permissions:
       contents: write
+      issues: read
       pull-requests: write
     outputs:
       explanation: ${{ steps.explanation.outputs.text }}
     # only run on push event if plan wasn't updated (don't create a release plan when we're releasing)
     # only run on labeled event if the PR has already been merged
-    if: (github.event_name == 'push' && needs.check-plan.outputs.command != 'release') || (github.event_name == 'pull_request' && github.event.pull_request.merged == true)
+    if: (github.event_name == 'push' && needs.check-plan.outputs.command != 'release') || (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true)
 
     steps:
       - uses: actions/checkout@v4
@@ -50,36 +52,32 @@ jobs:
         with:
           fetch-depth: 0
           ref: "main"
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 18
-
-      - uses: pnpm/action-setup@v3
-        with:
-          version: 8
+          cache: pnpm
       - run: pnpm install --frozen-lockfile
-
       - name: "Generate Explanation and Prep Changelogs"
         id: explanation
         run: |
           set +e
-
-          pnpm release-plan prepare --single-package=@bertdeblock/gember 2> >(tee -a stderr.log >&2)
-
+          pnpm release-plan prepare --single-package=@bertdeblock/gember 2> >(tee -a release-plan-stderr.txt >&2)
 
           if [ $? -ne 0 ]; then
             echo 'text<<EOF' >> $GITHUB_OUTPUT
-            cat stderr.log >> $GITHUB_OUTPUT
+            cat release-plan-stderr.txt >> $GITHUB_OUTPUT
             echo 'EOF' >> $GITHUB_OUTPUT
           else
             echo 'text<<EOF' >> $GITHUB_OUTPUT
             jq .description .release-plan.json -r >> $GITHUB_OUTPUT
             echo 'EOF' >> $GITHUB_OUTPUT
+            rm release-plan-stderr.txt
           fi
         env:
           GITHUB_AUTH: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: peter-evans/create-pull-request@v6
+      - uses: peter-evans/create-pull-request@v7
         with:
           commit-message: "Prepare Release using 'release-plan'"
           labels: "internal"

.github/workflows/publish.yml

@@ -41,22 +41,21 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      id-token: write
+      attestations: write
 
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 18
           # This creates an .npmrc that reads the NODE_AUTH_TOKEN environment variable
           registry-url: "https://registry.npmjs.org"
-
-      - uses: pnpm/action-setup@v3
-        with:
-          version: 8
+          cache: pnpm
       - run: pnpm install --frozen-lockfile
       - name: npm publish
-        run: pnpm release-plan publish
-
+        run: NPM_CONFIG_PROVENANCE=true pnpm release-plan publish
         env:
           GITHUB_AUTH: ${{ secrets.GITHUB_TOKEN }}
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.gitignore

@@ -3,6 +3,3 @@
 /node_modules/
 /test/output/
 /.eslintcache
-
-# https://github.com/embroider-build/create-release-plan-setup/issues/88
-/stderr.log

package.json

@@ -39,22 +39,22 @@
   "devDependencies": {
     "@eslint/js": "^9.15.0",
     "@types/fs-extra": "^11.0.4",
-    "@types/node": "^22.9.1",
+    "@types/node": "^22.10.0",
     "@types/yargs": "^17.0.33",
-    "@vitest/coverage-v8": "^2.1.5",
+    "@vitest/coverage-v8": "^2.1.6",
     "concurrently": "^9.1.0",
     "eslint": "^9.15.0",
-    "eslint-plugin-n": "^17.13.2",
+    "eslint-plugin-n": "^17.14.0",
     "execa": "^9.5.1",
     "fixturify-project": "^7.1.3",
-    "prettier": "^3.3.3",
+    "prettier": "^3.4.1",
     "recursive-copy": "^2.0.14",
-    "release-plan": "^0.10.0",
-    "type-fest": "^4.27.0",
-    "typescript": "^5.6.3",
-    "typescript-eslint": "^8.15.0",
+    "release-plan": "^0.11.0",
+    "type-fest": "^4.28.1",
+    "typescript": "^5.7.2",
+    "typescript-eslint": "^8.16.0",
     "uuid": "^11.0.3",
-    "vitest": "^2.1.5"
+    "vitest": "^2.1.6"
   },
   "packageManager": "[email protected]",
   "engines": {