build: added trusted publishing

Author: alanscodelog

.github/actions/composite-build/action.yml

@@ -1,31 +1,18 @@
 name: Build
-inputs:
-  build_script:
-    required: false
-    type: boolean
-    default: "pnpm build"
-  lint_script:
-    required: false
-    type: boolean
-    default: "pnpm lint"
-  test_script:
-    required: false
-    type: boolean
-    default: "pnpm test"
 
 # note it cannot contain the checkout, the must be checked out in the calling workflow or it will not be able to find the composite action
 runs:
   using: "composite"
   steps:
-    - run: ${{ inputs.build_script }}
+    - run: pnpm build
       shell: bash
 
-    - run: ${{ inputs.lint_script }}
+    - run: pnpm lint
       shell: bash
 
-    - run: ${{ inputs.test_script }}
+    - run: pnpm test
       shell: bash
-
+    
     - name: Coverage
       if: ${{ github.event_name == 'pull_request' }}
       uses: romeovs/lcov-reporter-action@v0.3.1

.github/workflows/docs.yml

@@ -32,6 +32,8 @@ jobs:
     - name: Build 
       uses: ./.github/actions/composite-build
       if: "env.ENABLE_DOCS == 'true'"
+      with:
+        USE_LOCKFILE: ${{ env.USE_LOCKFILE }}
 
     - run: pnpm doc
       if: "env.ENABLE_DOCS == 'true'"

.github/workflows/release.yml

@@ -10,13 +10,20 @@ on:
   repository_dispatch:
     types: [ release ]
 
+permissions:
+  id-token: write 
+
 jobs:
   release:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         node-version: ["lts/*"]
-
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for trusted publishing and npm provenance
     steps:
     - uses: actions/checkout@v6
 
@@ -30,20 +37,21 @@ jobs:
 
     - name: Build
       uses: ./.github/actions/composite-build
+      with:
+        USE_LOCKFILE: ${{ secrets.USE_LOCKFILE }}
+
 
     - name: Release
       if: "env.ENABLE_RELEASE == 'true' && ! contains('refs/heads/build ', github.ref)"
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       run: pnpm semantic-release
 
     - name: Release Dry Run
       if: "env.ENABLE_RELEASE != 'true' || contains('refs/heads/build ', github.ref)"
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      run: pnpm semantic-release --dry-run
+      run: pnpm semantic-release --dry-run 
 
     - run: echo "env.ENABLE_RELEASE is ${{ env.ENABLE_RELEASE == 'true' }} and branch is ${{ github.ref }}, no release can be published." && exit 1
       if: "env.ENABLE_RELEASE != 'true' || contains('refs/heads/build ', github.ref)"