chore(PLAT-2937) - Add publish.yml workflow using Trusted Provider

Author: burkematthew

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [18, 20]
+        node-version: [20, 22, 24]
 
     services:
       redis:
@@ -35,6 +35,9 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
 
+      - name: Upgrade npm to v11
+        run: npm install -g npm@11
+
       - name: Install dependencies
         run: npm install
 

.github/workflows/publish.yml

@@ -1,30 +1,61 @@
-name: "Publish to npm"
+name: NPM Publish
 
 on:
-  release:
-    types: [created]
+  workflow_dispatch:
+    inputs:
+      version:
+        type: choice
+        description: Version type
+        required: true
+        options:
+          - "patch"
+          - "minor"
+          - "major"
+        default: "patch"
 
 jobs:
   publish:
-    name: Publish release to npm
     runs-on: ubuntu-latest
-
+    permissions:
+      id-token: write # Required for publishing using OIDC authentication
+      contents: write
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Use Node
+      - name: Setup Node
         uses: actions/setup-node@v4
         with:
           node-version-file: '.node-version'
+          cache: 'npm'
+
+      - name: Upgrade npm to v11
+        run: npm install -g npm@11
 
       - name: Install dependencies
         run: npm install
 
-      - name: publish to npm
-        id: publish
-        uses: JS-DevTools/npm-publish@v3
-        with:
-          token: ${{ secrets.NPM_TOKEN }}
+      - name: Run tests and linter
+        run: npm test
+
+      - name: Enforce coverage
+        run: npm run enforce
+
+      - name: Configure Git
+        run: |
+          git config --global user.email "no-reply@lob.com"
+          git config --global user.name "NPM Publish Action"
+
+      - name: Generate changelog
+        run: npm run changelog:${{ github.event.inputs.version }}
+
+      - name: Commit changelog
+        run: npm run version:commit
+
+      - name: Bump version
+        run: npm version "${{ github.event.inputs.version }}"
 
+      - name: Publish package
+        uses: JS-DevTools/npm-publish@v4
 
+      - name: Push changes to Github
+        run: git push --follow-tags

.node-version

@@ -1 +1 @@
-20.15.0
+20.17.0

package-lock.json

@@ -8,9 +8,10 @@
     "lint": "eslint .",
     "test": "nyc _mocha test --exit --require test/setup.js --recursive --timeout 30000",
     "test:raw": "mocha test --require test/setup.js --recursive --timeout 30000",
-    "release:major": "changelog -M && git add CHANGELOG.md && git commit -m 'updated CHANGELOG.md' && npm version major && git push origin && git push origin --tags",
-    "release:minor": "changelog -m && git add CHANGELOG.md && git commit -m 'updated CHANGELOG.md' && npm version minor && git push origin && git push origin --tags",
-    "release:patch": "changelog -p && git add CHANGELOG.md && git commit -m 'updated CHANGELOG.md' && npm version patch && git push origin && git push origin --tags"
+    "changelog:patch": "changelog -p",
+    "changelog:minor": "changelog -m",
+    "changelog:major": "changelog -M",
+    "version:commit": "git add CHANGELOG.md && git commit -m 'updated CHANGELOG.md'"
   },
   "repository": {
     "type": "git",
@@ -27,6 +28,10 @@
     "url": "https://github.com/lob/hapi-bookshelf-total-count/issues"
   },
   "homepage": "https://github.com/lob/hapi-bookshelf-total-count#readme",
+  "engines": {
+    "node": ">=20.17.0",
+    "npm": ">=11.5.1"
+  },
   "peerDependencies": {
     "@hapi/hapi": "^21.3.10",
     "bookshelf": ">=1.2.0",