fix: enable npm provenance publishing

Author: hasezoey

.github/workflows/tests.yml

@@ -5,15 +5,22 @@ name: Node.js CI
 
 on:
   push:
+    branches-ignore:
+      - 'gh-pages'
   pull_request:
   workflow_dispatch:
     inputs:
       git-ref:
         description: Git Ref (Optional)
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   tests:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
     runs-on: ${{ matrix.distro }}
     strategy:
       matrix:
@@ -76,6 +83,11 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
 
   publish:
+    permissions:
+      contents: write  # for actions/checkout to fetch code and for semantic-release to push commits, release releases and tags
+      issues: write # for semantic-release to comment on and close issues
+      pull-requests: write # for semantic-release to comment on and close pull requests
+      id-token: write # for semantic-release to enable use of OIDC for npm provenance
     if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/beta' || startsWith(github.ref, 'refs/heads/old')
     needs: [tests]
     runs-on: ubuntu-latest
@@ -104,4 +116,5 @@ jobs:
             [email protected]
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # replace with trusted-publishing once available, see https://github.com/semantic-release/npm/issues/958
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

packages/mongodb-memory-server-core/package.json

@@ -31,6 +31,10 @@
     "url": "https://github.com/typegoose/mongodb-memory-server/issues"
   },
   "homepage": "https://github.com/typegoose/mongodb-memory-server",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "devDependencies": {
     "@types/debug": "^4.1.12",
     "@types/find-cache-dir": "^3.2.1",
@@ -56,6 +60,7 @@
     "tslib": "^2.8.1",
     "yauzl": "^3.2.0"
   },
+
   "scripts": {
     "clean": "rimraf tmp lib build coverage node_modules/.cache",
     "build": "rimraf ./lib && tsc -p ./tsconfig.build.json",

packages/mongodb-memory-server-global-4.0/package.json

@@ -24,6 +24,10 @@
     "mongodb-prebuilt",
     "mongomem"
   ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "dependencies": {
     "mongodb-memory-server-core": "10.2.2",
     "tslib": "^2.8.1"

packages/mongodb-memory-server-global-4.2/package.json

@@ -24,6 +24,10 @@
     "mongodb-prebuilt",
     "mongomem"
   ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "dependencies": {
     "mongodb-memory-server-core": "10.2.2",
     "tslib": "^2.8.1"

packages/mongodb-memory-server-global-4.4/package.json

@@ -24,6 +24,10 @@
     "mongodb-prebuilt",
     "mongomem"
   ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "dependencies": {
     "mongodb-memory-server-core": "10.2.2",
     "tslib": "^2.8.1"

packages/mongodb-memory-server-global/package.json

@@ -23,6 +23,10 @@
     "mongodb-prebuilt",
     "mongomem"
   ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "dependencies": {
     "mongodb-memory-server-core": "10.2.2",
     "tslib": "^2.8.1"

packages/mongodb-memory-server/package.json

@@ -23,6 +23,10 @@
     "mongodb-prebuilt",
     "mongomem"
   ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "dependencies": {
     "mongodb-memory-server-core": "10.2.2",
     "tslib": "^2.8.1"