Enable trusted publishing

.github/actions/publish-libs/action.yml

@@ -8,9 +8,6 @@ inputs:
   github_token:
     description: 'Github token'
     required: true
-  npm_registry_token:
-    description: 'NPM registry token'
-    required: true
   npm_tag:
     description: 'NPM tag'
     required: true
@@ -29,9 +26,11 @@ runs:
 
     - name: Build Libraries
       shell: bash
-      run: npm ci && npx nx run-many --target=build
+      run: |
+        npm ci
+        npm run ci:build:many
 
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v6
       name: setup GH registry
       with:
         node-version-file: '.nvmrc'
@@ -46,7 +45,7 @@ runs:
         TAG: ${{ inputs.npm_tag }}
         DRY_RUN: ${{ inputs.dry-run }}
 
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v6
       name: setup NPM registry
       with:
         node-version-file: '.nvmrc'
@@ -57,6 +56,5 @@ runs:
       shell: bash
       run: ${{ github.action_path }}/npm-publish.sh "$TAG" "$DRY_RUN"
       env:
-        NODE_AUTH_TOKEN: ${{ inputs.npm_registry_token }}
         TAG: ${{ inputs.npm_tag }}
         DRY_RUN: ${{ inputs.dry-run }}

.github/actions/publish-libs/npm-publish.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -e
+
 ROOT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )/../../.." && pwd )"
 DIST_DIR="$ROOT_DIR/dist/@alfresco"
 TAG=$1

.github/workflows/release.yml

@@ -39,6 +39,10 @@ on:
       - master
       - develop
 
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
 env:
   BASE_URL: ${{ secrets.PIPELINE_ENV_URL }}
   ADMIN_EMAIL: ${{ secrets.PIPELINE_ADMIN_USERNAME }}
@@ -52,12 +56,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -78,12 +82,12 @@ jobs:
           - name: "aca-shared"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -102,11 +106,11 @@ jobs:
         run: exit 1
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -139,11 +143,11 @@ jobs:
         run: exit 1
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -176,18 +180,18 @@ jobs:
         run: exit 1
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
       - uses: ./.github/actions/setup
         with:
           npm_tag: ${{ inputs.npm-tag }}
-      - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v8.24.1
+      - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@3768f40c71f5f9b0c4e6a507c8f87ed40d9b60c9 #v12.9.0
         with:
           username: ${{ vars.BOT_GITHUB_USERNAME }}
           email: ${{ vars.BOT_GITHUB_EMAIL }}
@@ -205,6 +209,8 @@ jobs:
     name: "Publish libs to NPM and GitHub registry"
     runs-on: ubuntu-latest
     permissions:
+      id-token: write  # Required for OIDC
+      contents: read
       packages: write
     steps:
       - name: Check previous jobs status
@@ -212,12 +218,12 @@ jobs:
         run: exit 1
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 2
 
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -230,8 +236,7 @@ jobs:
         uses: ./.github/actions/publish-libs
         with:
           branch_name: ${{ env.BRANCH_NAME }}
-          github_token: ${{ secrets.BOT_GITHUB_TOKEN }}
-          npm_registry_token: ${{ secrets.NPM_REGISTRY_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
           npm_tag: ${{ env.TAG_NPM }}
           dry-run: ${{ inputs.dry-run-release }}
 
@@ -245,10 +250,10 @@ jobs:
       actions: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Push Source Files to Crowdin
-        uses: crowdin/github-action@297234bae049541aa48ed268e5de00dee4efa4b4 # v2.8.0
+        uses: crowdin/github-action@b4b468cffefb50bdd99dd83e5d2eaeb63c880380 # v2.14.0
         with:
           upload_sources: true
           upload_sources_args: --delete-obsolete

.nvmrc

@@ -1 +1 @@
-22.14.0
+24.11.1