@@ -78,18 +78,18 @@ jobs:
7878 publish-npm :
7979 runs-on : ubuntu-latest
8080 needs : [build-windows, build-linux, build-mac]
81+ permissions :
82+ id-token : write # Required for OIDC
83+ contents : write # For git operations
8184 steps :
8285 - uses : actions/checkout@v4
8386 with :
84- # With permission to push to a protected branch
8587 token : ${{ secrets.READ_WRITE_PAT }}
86- fetch-depth : 0 # Required to find branches for a tag
88+ fetch-depth : 0
8789
8890 - name : Determine release branch
8991 id : get_branch
9092 run : |
91- # Find the branch that contains the tag.
92- # Prefers 'main', then 'master', then the first branch found.
9393 BRANCHES=$(git branch -r --contains ${{ github.ref_name }} | sed 's/ *origin\///' | grep -v HEAD)
9494 if echo "$BRANCHES" | grep -q -w "main"; then
9595 RELEASE_BRANCH="main"
@@ -109,8 +109,10 @@ jobs:
109109 node-version : " 20.x"
110110 registry-url : " https://registry.npmjs.org"
111111
112+ - name : Upgrade npm to latest version
113+ run : npm install -g npm@latest
114+
112115 - name : Get GitHub tag version
113- # Store the version, stripping any v-prefix
114116 id : tag-version
115117 run : |
116118 TAG_VERSION=${GITHUB_REF_NAME#v}
@@ -128,9 +130,9 @@ jobs:
128130 uses : EndBug/add-and-commit@v9
129131 with :
130132 default_author : github_actions
131- message : ' Update package.json version to ${{ steps.tag-version.outputs.TAG_VERSION }}'
132- add : ' package.json'
133-
133+ message : " Update package.json version to ${{ steps.tag-version.outputs.TAG_VERSION }}"
134+ add : " package.json"
135+
134136 - run : npm ci
135137
136138 - name : Determine npm tag for pre-releases
@@ -144,6 +146,4 @@ jobs:
144146 echo "tag=${NPM_TAG}" >> $GITHUB_OUTPUT
145147 echo "npm tag: ${NPM_TAG}"
146148
147- run : npm publish --tag ${{ steps.npm_tag.outputs.tag }}
148- env :
149- NODE_AUTH_TOKEN : ${{ secrets.NPM_TOKEN }}
149+ run : npm publish --provenance --tag ${{ steps.npm_tag.outputs.tag }}
0 commit comments