chore(ci-cd): trusted publisher using oidc

trusted publisher using oidc

GH-0

Author: Tyagi-Sunny

.github/workflows/release.yml

@@ -1,52 +1,58 @@
 # This Manually Executable Workflow is for NPM Releases
-
 name: Release [Manual]
 on: workflow_dispatch
+
 permissions:
   contents: write
+  id-token: write   # REQUIRED for trusted publishing
+
 jobs:
   Release:
     runs-on: ubuntu-latest
+    # Specify environment if you configured one in npm
+    # environment: production  # Uncomment if you set an environment name in npm trusted publisher settings
+
     steps:
       - uses: actions/checkout@v3
         with:
           # fetch-depth is necessary to get all tags
           # otherwise lerna can't detect the changes and will end up bumping the versions for all packages
           fetch-depth: 0
           token: ${{ secrets.RELEASE_COMMIT_GH_PAT }}
+
       - name: Setup Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4  # UPDATED to v4
         with:
-          node-version: '20.x'
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+          always-auth: false  # important for trusted publishing
+
       - name: Configure CI Git User
         run: |
           git config --global user.name $CONFIG_USERNAME
           git config --global user.email $CONFIG_EMAIL
-          git remote set-url origin https://$GITHUB_ACTOR:[email protected]/sourcefuse/loopback4-message-bus-connector
+          git remote set-url origin https://$GITHUB_ACTOR:[email protected]/sourcefuse/loopback4-notifications
         env:
           GITHUB_PAT: ${{ secrets.RELEASE_COMMIT_GH_PAT }}
           CONFIG_USERNAME: ${{ vars.RELEASE_COMMIT_USERNAME }}
           CONFIG_EMAIL: ${{ vars.RELEASE_COMMIT_EMAIL }}
-      - name: Authenticate with Registry
-        run: |
-          echo "@${NPM_USERNAME}:registry=https://registry.npmjs.org/" > .npmrc
-          echo "registry=https://registry.npmjs.org/" >> .npmrc
-          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> .npmrc
-          npm whoami
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_USERNAME: ${{ vars.NPM_USERNAME }}
 
       - name: Install 📌
-        run: |
-          npm install
+        run: npm install
+
       - name: Test 🔧
         run: npm run test
+
+      # ✅ CHANGED THIS SECTION
       - name: Semantic Publish to NPM 🚀
-        # "HUSKY=0" disables pre-commit-msg check (Needed in order to allow semantic-release perform the release commit)
-        run: HUSKY=0 npx semantic-release
+        run: |
+          npm config set provenance true
+
+          HUSKY=0 npx semantic-release
         env:
           GH_TOKEN: ${{ secrets.RELEASE_COMMIT_GH_PAT }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # REMOVED: NPM_TOKEN is not needed with trusted publishing
+          # The id-token: write permission above handles authentication
+
       - name: Changelog 📝
-        run: cd src/release_notes && HUSKY=0 node release-notes.js
+        run: cd src/release_notes && HUSKY=0 node release-notes.js

package-lock.json

@@ -88,6 +88,7 @@
     "@semantic-release/changelog": "^6.0.1",
     "@semantic-release/commit-analyzer": "^9.0.2",
     "@semantic-release/git": "^10.0.1",
+    "@semantic-release/github": "^12.0.0",
     "@semantic-release/npm": "^13.1.1",
     "@semantic-release/release-notes-generator": "^10.0.3",
     "@loopback/testlab": "^8.0.3",
@@ -114,9 +115,6 @@
     "registry": "https://registry.npmjs.org/"
   },
   "overrides": {
-    "@semantic-release/npm": {
-      "npm": "^11.7.0"
-    },
     "git-release-notes": {
       "ejs": "^3.1.8",
       "yargs": "^17.6.2"
@@ -149,7 +147,14 @@
         }
       ],
       "@semantic-release/release-notes-generator",
-      "@semantic-release/npm",
+      [
+        "@semantic-release/npm",
+        {
+          "npmPublish": true,
+          "pkgRoot": ".",
+          "tarballDir": "dist"
+        }
+      ],
       [
         "@semantic-release/git",
         {
@@ -162,6 +167,6 @@
       ],
       "@semantic-release/github"
     ],
-    "repositoryUrl": "git@github.com:sourcefuse/loopback4-message-bus-connector.git"
+    "repositoryUrl": "https://github.com/sourcefuse/loopback4-message-bus-connector.git"
   }
-}
+}