Tim van der Meij
8eb747663a
Use OIDC trusted publishing in the GitHub Actions release workflow
...
This commit updates the release pipeline to use OIDC trusted publishing
now that we have configured it between GitHub Actions and NPM. This
solution allows us to remove the token variable (because there is no
longer a fixed token) and provenance flag (because provenance
attestations are generated by default with this approach); refer to
https://docs.npmjs.com/trusted-publishers for more information.
2025-11-28 21:01:13 +01:00
dependabot[bot]
f6ad1a5610
Bump actions/checkout from 5 to 6
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
2025-11-24 12:42:52 +00:00
dependabot[bot]
6268f930ca
Bump actions/setup-node from 5 to 6
...
Bumps [actions/setup-node](https://github.com/actions/setup-node ) from 5 to 6.
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
2025-10-20 12:57:45 +00:00
dependabot[bot]
f9be06a8c1
Bump actions/setup-node from 4 to 5
...
Bumps [actions/setup-node](https://github.com/actions/setup-node ) from 4 to 5.
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
2025-09-08 12:31:52 +00:00
dependabot[bot]
e38fb68724
Bump actions/checkout from 4 to 5
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
2025-08-11 17:13:51 +00:00
Tim van der Meij
7114796430
Merge pull request #18352 from wojtekmaj/provenance
...
Generate provenance statements on npm publish
2024-07-01 17:42:16 +02:00
Wojciech Maj
aaa65bf3fc
Generate provenance statements on npm publish
...
This PR adds [Provenance statements](https://docs.npmjs.com/generating-provenance-statements ) on `npm publish`, increasing supply-chain security.
2024-07-01 15:37:25 +02:00
Wojciech Maj
6b449d8884
Use npm ci, not npm install, on CI
...
This PR switches from `npm install` to `npm ci` on CI. This enables some additional checks to ensure repo integrity when using CI/CD.
Read more: https://docs.npmjs.com/cli/v10/commands/npm-ci
2024-07-01 13:46:23 +02:00
Tim van der Meij
a5f2b9faeb
Introduce a GitHub Actions workflow for publishing a release
...
This commit migrates this functionality away from the bots. Note that
the NPM token must be configured as a repository secret before this
workflow can execute.
The following resources are relevant for this patch:
- Publishing packages to the NPM registry:
https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages#publishing-packages-to-the-npm-registry
- Creating secrets for a repository:
https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository
2024-06-30 16:03:52 +02:00
