ci: Update workflows to Node 24 and enable OIDC publishing (#716)

* ci: Update workflows to Node 24 and enable OIDC publishing

Updates:
- Upgrade actions/checkout from v4 to v5
- Upgrade actions/setup-node from v4 to v6
- Update Node.js version from 22 to 24 across all workflows
- Enable OIDC authentication in publish.yml workflow
  - Add id-token: write permission for npm OIDC
  - Remove NPM_TOKEN secret requirement
  - Add comments explaining OIDC usage
- Fix package.json metadata:
  - sui/ts: Correct repository URLs and add homepage
  - evm/ts: Add missing homepage field

OIDC publishing requires npm CLI 11.5.1+ (included in Node 24) and
trusted publisher configuration on npmjs.com for each package.

* sdk/test: Run hub tests sequentially to prevent nonce collisions

Parallel execution with Promise.all caused EVM nonce conflicts when both test instances tried to send transactions from the same accounts simultaneously. Running sequentially ensures proper nonce ordering.

Author: DBosley

.github/actions/setup-anchor/action.yml

@@ -17,7 +17,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v6
       with:
         node-version: ${{ inputs.node-version }}
     - name: Cache Solana CLI tools

.github/workflows/cli.yml

@@ -11,11 +11,11 @@ jobs:
   test-evm:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - run: docker build -f Dockerfile.cli --target cli-local-test . --progress=plain
 
   test-solana:
     runs-on: tilt-kube-public
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - run: docker build -f Dockerfile.cli --target cli-local-test-solana . --progress=plain

.github/workflows/evm.yml

@@ -22,7 +22,7 @@ jobs:
     name: forge test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           submodules: recursive
 
@@ -54,7 +54,7 @@ jobs:
     name: echidna
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           submodules: recursive
 

.github/workflows/publish.yml

@@ -11,14 +11,18 @@ on:
 jobs:
   publish-ts-sdk:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # Required for OIDC authentication with npm
+      contents: read
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
           cache: "npm"
           registry-url: "https://registry.npmjs.org"
+          # Node 24 ships with npm 11.x which includes OIDC support (requires 11.5.1+)
       - run: npm ci
       - run: npm run version ${{ inputs.version }}
       - run: npm run build --if-present
@@ -38,7 +42,8 @@ jobs:
             --workspace solana \
             --workspace sui \
             --workspace sdk/route
+        # OIDC authentication is used automatically by npm CLI 11.5.1+
+        # No NPM_TOKEN secret needed - authentication happens via OpenID Connect
+        # See: https://docs.npmjs.com/trusted-publishers/
         env:
           VERSION: ${{ inputs.version }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          # https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages#publishing-packages-to-the-npm-registry

.github/workflows/sdk.yml

@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
           cache: "npm"
           registry-url: "https://registry.npmjs.org"
       - run: npm ci

.github/workflows/solana.yml

@@ -18,7 +18,7 @@ jobs:
     env:
       RUSTFLAGS: -Dwarnings
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Get rust toolchain version
         id: toolchain
@@ -88,7 +88,7 @@ jobs:
     name: Check version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - run: ./scripts/sync-versions --check
         shell: bash
@@ -97,11 +97,11 @@ jobs:
     name: Anchor Test
     runs-on: ubuntu-latest
     env:
-      node-version: "20.11.0"
+      node-version: "24"
       solana-cli-version: "1.18.26"
       anchor-version: "0.29.0"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - uses: ./.github/actions/setup-anchor
         with:

.github/workflows/tilt.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Clear repository
         run: |
           rm -rf $GITHUB_WORKSPACE && mkdir $GITHUB_WORKSPACE
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           submodules: recursive
       - name: Expand for link to Tilt dashboard (only available during build)

evm/ts/package.json

@@ -8,6 +8,7 @@
   "bugs": {
     "url": "https://github.com/wormhole-foundation/native-token-transfers"
   },
+  "homepage": "https://github.com/wormhole-foundation/native-token-transfers#readme",
   "directories": {
     "test": "__tests__"
   },

sdk/__tests__/index.test.ts

@@ -71,21 +71,19 @@ describe("Hub and Spoke Tests", function () {
   });
 
   test("Test Solana and Ethereum Hubs", async () => {
-    await Promise.all([
-      testHub(
-        "Solana",
-        "Ethereum",
-        "Bsc",
-        makeGetNativeSigner(ETH_PRIVATE_KEY, SOL_PRIVATE_KEY),
-        ACCT_MNEMONIC
-      ),
-      testHub(
-        "Ethereum",
-        "Bsc",
-        "Solana",
-        makeGetNativeSigner(ETH_PRIVATE_KEY_2, SOL_PRIVATE_KEY_2),
-        ACCT_MNEMONIC_2
-      ),
-    ]);
+    await testHub(
+      "Solana",
+      "Ethereum",
+      "Bsc",
+      makeGetNativeSigner(ETH_PRIVATE_KEY, SOL_PRIVATE_KEY),
+      ACCT_MNEMONIC
+    );
+    await testHub(
+      "Ethereum",
+      "Bsc",
+      "Solana",
+      makeGetNativeSigner(ETH_PRIVATE_KEY_2, SOL_PRIVATE_KEY_2),
+      ACCT_MNEMONIC_2
+    );
   });
 });

sui/ts/package.json

@@ -3,11 +3,12 @@
   "version": "0.5.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/wormhole-foundation/example-native-token-transfers.git"
+    "url": "git+https://github.com/wormhole-foundation/native-token-transfers.git"
   },
   "bugs": {
-    "url": "https://github.com/wormhole-foundation/example-native-token-transfers"
+    "url": "https://github.com/wormhole-foundation/native-token-transfers"
   },
+  "homepage": "https://github.com/wormhole-foundation/native-token-transfers#readme",
   "directories": {
     "test": "__tests__"
   },