ci: publish to npm via trusted publishing (OIDC) (#144)

.github/actions/setup/action.yml

@@ -5,12 +5,12 @@ runs:
   using: composite
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v5
       with:
-        node-version: '20.x'
+        node-version: '24.x'
     - name: Cache dependencies
       id: yarn-cache
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |
           **/node_modules

.github/workflows/ci.yml

@@ -7,13 +7,20 @@ on:
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    # Must match the Environment on npm's trusted publisher for this package
+    environment: prod
     # Prevent the app's own release commit from re-triggering this workflow
     if: github.actor != 'stallion-release-bot[bot]'
-    permissions: write-all
+    # id-token: write mints the OIDC token npm's trusted publisher verifies
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      id-token: write
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.RELEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
@@ -42,11 +49,13 @@ jobs:
       - name: Prep release
         run: yarn prepare-release
 
+      # Publishes to npm via trusted publishing, so no NPM_TOKEN is needed.
+      # npm binds the trusted publisher to this workflow's file name: renaming
+      # ci.yml means updating the publisher on npmjs.com in the same change.
       - name: Release package
         run: yarn semantic-release
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           GIT_AUTHOR_EMAIL: ${{ secrets.GH_DEPLOY_EMAIL }}
           GIT_AUTHOR_NAME: ${{ secrets.GH_DEPLOY_NAME }}
           GIT_COMMITTER_EMAIL: ${{ secrets.GH_DEPLOY_EMAIL }}

package.json

@@ -60,8 +60,8 @@
     "@commitlint/config-conventional": "^17.0.2",
     "@evilmartians/lefthook": "^1.2.2",
     "@react-native-community/eslint-config": "^3.0.2",
-    "@semantic-release/changelog": "6.0.0",
-    "@semantic-release/git": "10.0.0",
+    "@semantic-release/changelog": "7.0.0",
+    "@semantic-release/git": "11.0.1",
     "@types/jest": "^28.1.2",
     "@types/react": "~17.0.21",
     "@types/react-native": "0.70.0",
@@ -79,7 +79,7 @@
     "react-native": "0.71.7",
     "react-native-builder-bob": "^0.20.0",
     "rimraf": "3.0.2",
-    "semantic-release": "19.0.3",
+    "semantic-release": "25.0.9",
     "tsconfig-paths": "^4.2.0",
     "typescript": "^4.5.2"
   },