Configure trusted publishing

Author: ecraig12345

.github/workflows/pr.yml

@@ -22,28 +22,47 @@ jobs:
   build:
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest]
-        npm: [8]
         include:
           - os: ubuntu-latest
             # npm 6 and 8 have slightly different behavior with verdaccio in publishing tests.
             # It's unclear if this translates to meaningful differences in behavior in actual scenarios,
             # but test against both versions to be safe. (Only do this on the ubuntu build for speed.)
             npm: 6
+            node: 14
+          # node 14/npm 8 on ubuntu and windows
+          - os: ubuntu-latest
+            npm: 8
+            node: 14
+          - os: windows-latest
+            npm: 8
+            node: 14
+          # node 22/npm 11 on ubuntu and windows
+          - os: ubuntu-latest
+            npm: 11
+            node: 22
+          - os: windows-latest
+            npm: 11
+            node: 22
 
-    name: build (${{ matrix.os }}, npm ${{ matrix.npm }})
+    name: build (${{ matrix.os }}, node ${{ matrix.node }}, npm ${{ matrix.npm }})
 
     runs-on: ${{ matrix.os }}
 
     steps:
       - name: Check out code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - name: Install Node.js from .nvmrc
+      - name: Install Node.js ${{ matrix.node }}
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           cache: yarn
-          node-version-file: .nvmrc
+          node-version: ${{ matrix.node }}
+
+      # Temporary extra command to work around weird node issue (swich to just npm i -g npm once fixed)
+      # https://github.com/nodejs/node/issues/62425#issuecomment-4200715930
+      - name: node 22 npm workaround
+        if: matrix.node == 22
+        run: npm i -g npm@10.9.8
 
       # Guarantee a predictable version of npm for the first round of tests
       - name: Install npm@${{ matrix.npm }}

.github/workflows/release.yml

@@ -4,8 +4,10 @@ name: Release
 on:
   workflow_dispatch:
 
+# Use newer node and npm for trusted publishing support
 env:
-  npmVersion: 8
+  npmVersion: 11
+  nodeVersion: 22
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -26,14 +28,13 @@ jobs:
           # Don't save creds in the git config (so it's easier to override later)
           persist-credentials: false
 
-      - name: Install Node.js from .nvmrc
+      - name: Install Node.js ${{ env.nodeVersion }}
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version-file: .nvmrc
+          node-version: ${{ env.nodeVersion }}
 
-      # Guarantee a predictable version of npm (the PR build tests against both 6 and 8)
-      - name: Install package managers
-        run: npm install --global npm@${{ env.npmVersion }} yarn@1
+      - name: Install npm@${{ env.npmVersion }}
+        run: npm install --global npm@${{ env.npmVersion }}
 
       - run: yarn --frozen-lockfile
 
@@ -58,7 +59,6 @@ jobs:
           # Add a token to the remote URL for auth during release
           git remote set-url origin "https://$REPO_PAT@github.com/$GITHUB_REPOSITORY"
 
-          yarn release -y -n "$NPM_AUTHTOKEN"
+          yarn release -y
         env:
-          NPM_AUTHTOKEN: ${{ secrets.NPM_AUTHTOKEN }}
           REPO_PAT: ${{ secrets.REPO_PAT }}