feat: trusted publishers

.github/workflows/ci.yml

@@ -14,8 +14,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           cache: npm
           node-version-file: .nvmrc
@@ -26,8 +26,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           cache: npm
           node-version-file: .nvmrc
@@ -42,8 +42,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           cache: npm
           node-version-file: .nvmrc
@@ -60,8 +60,8 @@ jobs:
       - build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           cache: npm
           node-version-file: .nvmrc

.github/workflows/dist-tag.yml

@@ -21,6 +21,9 @@ jobs:
       VERSION: ${{ github.event.inputs.version }}
       DIST_TAG: ${{ github.event.inputs.dist-tag }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for OIDC and provenance (npm publish)
     steps:
       - uses: actions/checkout@v4
 
@@ -41,9 +44,6 @@ jobs:
             exit 1 ;;
           esac
 
-      - name: configure NPMJS token
-        run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc
-
       - name: NPM dist-tag
         run: |
           npm dist-tag add "@elastic/synthetics@${VERSION}" "${DIST_TAG}"

.github/workflows/release.yml

@@ -15,13 +15,14 @@ on:
         default: false
 
 permissions:
-  id-token: write # to enable use of OIDC for npm provenance
+  contents: read
 
 jobs:
   release:
     runs-on: ubuntu-latest
-    env:
-      NPM_CONFIG_PROVENANCE: true
+    permissions:
+      contents: read
+      id-token: write # required for OIDC and provenance (npm publish)
     steps:
       - name: Get token
         id: get_token
@@ -34,7 +35,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: ${{ steps.get_token.outputs.token }}
@@ -43,10 +44,12 @@ jobs:
         with:
           github-token: ${{ steps.get_token.outputs.token }}
 
-      - run: npm ci # runs npm prepublish
+      - uses: actions/setup-node@v5
+        with:
+          cache: npm
+          node-version-file: .nvmrc
 
-      - name: configure NPMJS token
-        run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc
+      - run: npm ci # runs npm prepublish
 
       - run: npx semantic-release --dry-run="${DRY_RUN}"
         env:

.releaserc

@@ -6,13 +6,7 @@
     [
       "@semantic-release/npm",
       {
-        "npmPublish": false
-      }
-    ],
-    [
-      "@semantic-release/exec",
-      {
-        "publishCmd": "npm publish"
+        "npmPublish": true
       }
     ],
     "@semantic-release/github"

package.json

@@ -81,7 +81,6 @@
   "devDependencies": {
     "@commitlint/cli": "^17.7.1",
     "@commitlint/config-conventional": "^17.7.0",
-    "@semantic-release/exec": "^6.0.3",
     "@types/babel__code-frame": "^7.0.3",
     "@types/jest": "^28.1.8",
     "@types/micromatch": "^4.0.9",
@@ -109,5 +108,9 @@
   },
   "engines": {
     "node": ">=18.20.3"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
   }
 }