From 7bb3cb131828761866b7ab96e3eaebe1b0b04441 Mon Sep 17 00:00:00 2001 From: Michael van Tellingen Date: Sun, 25 Oct 2026 10:34:14 +0100 Subject: [PATCH 1/3] ci: publish to npm with trusted publishing (OIDC) --- .github/workflows/release.yml | 22 +++++++++++++++++----- package.json | 7 ++++++- 2 files changed, 23 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bd81a85..a22d239 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -49,6 +49,11 @@ jobs: runs-on: ubuntu-latest if: github.ref == 'refs/heads/main' needs: build + environment: release + permissions: + id-token: write # npm trusted publishing (OIDC) + contents: write # push version-bump commit + tags + pull-requests: write # create/update the release PR steps: - name: Checkout uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 @@ -60,12 +65,19 @@ jobs: with: node-version: 22 + - name: Upgrade npm for trusted publishing + run: npm i -g npm@^11.6.4 + - name: Create and publish versions - uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0 + uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2 with: - title: "Release new version" - commit: "update version" - publish: pnpm publish:ci + # changesets/action v2 renamed every one of these inputs. + pr-title: "Release new version" + commit-message: "update version" + publish-script: pnpm publish:ci + # v2 pushes the release commit and tags through the GitHub API; the + # git CLI path keeps the previous behaviour. + push-with-git-cli: true env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + NPM_CONFIG_PROVENANCE: true diff --git a/package.json b/package.json index 624c685..9860d65 100644 --- a/package.json +++ b/package.json @@ -6,7 +6,8 @@ "description": "A simple library to parse environment variables", "keywords": [], "publishConfig": { - "access": "public" + "access": "public", + "provenance": true }, "type": "module", "main": "index.js", @@ -47,5 +48,9 @@ "typescript": "^5.8.3", "vite": "^8", "vitest": "^5.0.5" + }, + "repository": { + "type": "git", + "url": "git+https://github.com/labd/node-enviconf.git" } } From 88f2b4618c6bf931ec87870a54345239ddb33a84 Mon Sep 17 00:00:00 2001 From: Michael van Tellingen Date: Sun, 25 Oct 2026 10:35:26 +0100 Subject: [PATCH 2/3] build: update to pnpm 12 --- package.json | 2 +- pnpm-lock.yaml | 158 ++++++++++++++++++++++++++++++++++++++++++++ pnpm-workspace.yaml | 29 ++++++++ 3 files changed, 188 insertions(+), 1 deletion(-) create mode 100644 pnpm-workspace.yaml diff --git a/package.json b/package.json index 9860d65..bdf5c17 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "dist", "src" ], - "packageManager": "pnpm@9.15.3", + "packageManager": "pnpm@12.12.0", "scripts": { "build": "tsup", "check": "biome check && tsc", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 00397c0..9a27782 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1,3 +1,161 @@ +--- +lockfileVersion: '9.0' + +importers: + + .: + configDependencies: {} + packageManagerDependencies: + pnpm: + specifier: 12.12.0 + version: 12.12.0 + +packages: + + '@pnpm/exe.android-arm64@12.12.0': + resolution: {integrity: sha512-vIJjoHwxmR7/Cvb3Tq1yhy9FaNsHKvpCgHIy4gaR3ZILA35o7fnF1Tq0Iq/B+E/bh6rLu/vFVJ2qZxYzrAa2qg==} + cpu: [arm64] + os: [android] + + '@pnpm/exe.android-x64@12.12.0': + resolution: {integrity: sha512-stRTO6T93Y2f6KF6oTeCHClRebSrNu2lED1bTJoan0TpKSdn5XlYpYdfxdIAfNwaU7MhLnTH2BRROq1GzQriSg==} + cpu: [x64] + os: [android] + + '@pnpm/exe.darwin-arm64@12.12.0': + resolution: {integrity: sha512-yGekz0hxwvhSVB7/2V1NJYsuvLNg/VBjT5NuDMC6LZo9WH2SofWxquCjGMAI8rJ/BKlu00D2Mb+qQUCxVXjTGA==} + cpu: [arm64] + os: [darwin] + + '@pnpm/exe.darwin-x64@12.12.0': + resolution: {integrity: sha512-cPgf74DmC9g0QhGtLXGbf0UppzOio4PaBfuuzAvnCUdZHswYZJf/5fK+FFdsb0XzGnOZfHWh6b85j6DFM3Osaw==} + cpu: [x64] + os: [darwin] + + '@pnpm/exe.freebsd-x64@12.12.0': + resolution: {integrity: sha512-ucRPLV+4X4UOZKlmVNuoIrh1GDrNfA3+RUMp0oMA8yKIXQCuC/00s9TYmYqtKDKa+rfECgaQVCTV5sAQKGf8Lg==} + cpu: [x64] + os: [freebsd] + + '@pnpm/exe.linux-arm64-musl@12.12.0': + resolution: {integrity: sha512-ENN5I6jgU/Sq7r9PZ4KarCVp/VE9xHeWTzyVtitEnCGMwCloP4cFYmIo/K5DjHvwoxFi+aZbfin6iZ9X2tk0kQ==} + cpu: [arm64] + os: [linux] + libc: [musl] + + '@pnpm/exe.linux-arm64@12.12.0': + resolution: {integrity: sha512-CozuRC6yDaBIs2IDV6a+LpDU4FhgvRdpPoB4hRkpi0icQRL3h42g10HC50JWdRXV6ncaFkHnk0aCyd41IoCYkA==} + cpu: [arm64] + os: [linux] + libc: [glibc] + + '@pnpm/exe.linux-ppc64@12.12.0': + resolution: {integrity: sha512-90M93iTzm2CMUR+gEtku8zSEjDBe9KdZ/1SbpGsAkdLjmrrl+2Vohq25PrvLdZ47xT0IgIcHdrBggIUBKRJX/A==} + cpu: [ppc64] + os: [linux] + libc: [glibc] + + '@pnpm/exe.linux-riscv64@12.12.0': + resolution: {integrity: sha512-7vYCzHOWR/FI/Va3OCJdeffe1UZGDXx87UFLlvtP/wl0Q62U7LzvpAXf8AHa3nzSz3wjd+mTAbmCsmqRvP/a2w==} + cpu: [riscv64] + os: [linux] + libc: [glibc] + + '@pnpm/exe.linux-s390x@12.12.0': + resolution: {integrity: sha512-HP/lYvy7X0tI0TEvsj4QHQLaWMd3JlJaL+1PdTtZUdG/pe9OaZ/oppPA30rwayKHtl5yRm5nQy3X5j9FwzN9Uw==} + cpu: [s390x] + os: [linux] + libc: [glibc] + + '@pnpm/exe.linux-x64-musl@12.12.0': + resolution: {integrity: sha512-iYzGDLWNRZ89rZOVvIeWqS5L+HUc6eM+YrdxfMNhaJmx7bbUetp91pgQoYLGogdwy0/fFUixHP7AUXuLA9eoag==} + cpu: [x64] + os: [linux] + libc: [musl] + + '@pnpm/exe.linux-x64@12.12.0': + resolution: {integrity: sha512-eya3eIcq0zJebY85NT4+bl4VGGnOGZtIIHKd6mpMF2ttHF3ggn9gVp6R0rs/IT7frk7u0zg4dEbsHgauFBLNzA==} + cpu: [x64] + os: [linux] + libc: [glibc] + + '@pnpm/exe.win32-arm64@12.12.0': + resolution: {integrity: sha512-nrKDP/VB2DP7hIiuuFWdaI7YDlkYB3vVtZQvXUea5ixr3K/XJus00gGsSnH+XlS+jWDL9dpVTxJFzqDc8BNSgw==} + cpu: [arm64] + os: [win32] + + '@pnpm/exe.win32-x64@12.12.0': + resolution: {integrity: sha512-d6n8lJs1K0QHvwFHtti20pJ2vQjBWktmjPBnxuXFopDmZDSRVhY4q1E986jpy/xemgpfEnfCG+/nKcF0/cTQcg==} + cpu: [x64] + os: [win32] + + pnpm@12.12.0: + resolution: {integrity: sha512-LuBqyG21VM84RCFGEiDw4zakh7/UGyrNBOF6hrFIeDL+RejRdD9/xSrMd94S0jVrU2/t+CKfxIMjnkCxPUdESQ==} + engines: {node: '>=18.*'} + hasBin: true + +snapshots: + + '@pnpm/exe.android-arm64@12.12.0': + optional: true + + '@pnpm/exe.android-x64@12.12.0': + optional: true + + '@pnpm/exe.darwin-arm64@12.12.0': + optional: true + + '@pnpm/exe.darwin-x64@12.12.0': + optional: true + + '@pnpm/exe.freebsd-x64@12.12.0': + optional: true + + '@pnpm/exe.linux-arm64-musl@12.12.0': + optional: true + + '@pnpm/exe.linux-arm64@12.12.0': + optional: true + + '@pnpm/exe.linux-ppc64@12.12.0': + optional: true + + '@pnpm/exe.linux-riscv64@12.12.0': + optional: true + + '@pnpm/exe.linux-s390x@12.12.0': + optional: true + + '@pnpm/exe.linux-x64-musl@12.12.0': + optional: true + + '@pnpm/exe.linux-x64@12.12.0': + optional: true + + '@pnpm/exe.win32-arm64@12.12.0': + optional: true + + '@pnpm/exe.win32-x64@12.12.0': + optional: true + + pnpm@12.12.0: + optionalDependencies: + '@pnpm/exe.android-arm64': 12.12.0 + '@pnpm/exe.android-x64': 12.12.0 + '@pnpm/exe.darwin-arm64': 12.12.0 + '@pnpm/exe.darwin-x64': 12.12.0 + '@pnpm/exe.freebsd-x64': 12.12.0 + '@pnpm/exe.linux-arm64': 12.12.0 + '@pnpm/exe.linux-arm64-musl': 12.12.0 + '@pnpm/exe.linux-ppc64': 12.12.0 + '@pnpm/exe.linux-riscv64': 12.12.0 + '@pnpm/exe.linux-s390x': 12.12.0 + '@pnpm/exe.linux-x64': 12.12.0 + '@pnpm/exe.linux-x64-musl': 12.12.0 + '@pnpm/exe.win32-arm64': 12.12.0 + '@pnpm/exe.win32-x64': 12.12.0 + +--- lockfileVersion: '9.0' settings: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml new file mode 100644 index 0000000..00ffd61 --- /dev/null +++ b/pnpm-workspace.yaml @@ -0,0 +1,29 @@ +minimumReleaseAge: 20160 # 14 days +# Locked versions younger than 14 days when moving to pnpm 12; drop once they are older (after 2026-11-04). +minimumReleaseAgeExclude: + - "@oxc-project/types@0.155.0" + - "@rolldown/binding-android-arm-eabi@1.2.15" + - "@rolldown/binding-android-arm64@1.2.15" + - "@rolldown/binding-darwin-arm64@1.2.15" + - "@rolldown/binding-darwin-x64@1.2.15" + - "@rolldown/binding-freebsd-x64@1.2.15" + - "@rolldown/binding-linux-arm-gnueabihf@1.2.15" + - "@rolldown/binding-linux-arm64-gnu@1.2.15" + - "@rolldown/binding-linux-arm64-musl@1.2.15" + - "@rolldown/binding-linux-ppc64-gnu@1.2.15" + - "@rolldown/binding-linux-s390x-gnu@1.2.15" + - "@rolldown/binding-linux-x64-gnu@1.2.15" + - "@rolldown/binding-linux-x64-musl@1.2.15" + - "@rolldown/binding-openharmony-arm64@1.2.15" + - "@rolldown/binding-win32-arm64-msvc@1.2.15" + - "@rolldown/binding-win32-x64-msvc@1.2.15" + - "@vitest/coverage-v8@5.0.5" + - "@vitest/mocker@5.0.5" + - "@vitest/spy@5.0.5" + - "postcss@8.5.31" + - "rolldown@1.2.15" + - "vite@8.3.5" + - "vitest@5.0.5" + +allowBuilds: + esbuild: false # postinstall only verifies the platform binary; was already skipped under pnpm 9 From cffe35ee00e7902c094e5affabb2573029d232a5 Mon Sep 17 00:00:00 2001 From: Michael van Tellingen Date: Sun, 25 Oct 2026 10:35:26 +0100 Subject: [PATCH 3/3] ci: use gh-actions-typescript/pnpm-install v1.1.0 without cache in release --- .github/workflows/release.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a22d239..2ad84fa 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,7 +13,7 @@ jobs: uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Node.js - uses: labd/gh-actions-typescript/pnpm-install@e7a21fb56b52bf2d91616e34f0bc3f4f9a821b62 # v1.0.0 + uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0 with: node-version: 22 @@ -34,7 +34,7 @@ jobs: uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Node.js ${{ matrix.node }} - uses: labd/gh-actions-typescript/pnpm-install@e7a21fb56b52bf2d91616e34f0bc3f4f9a821b62 # v1.0.0 + uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0 with: node-version: ${{ matrix.node }} @@ -61,9 +61,10 @@ jobs: fetch-depth: 0 - name: Set up Node.js - uses: labd/gh-actions-typescript/pnpm-install@e7a21fb56b52bf2d91616e34f0bc3f4f9a821b62 # v1.0.0 + uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0 with: node-version: 22 + cache: false - name: Upgrade npm for trusted publishing run: npm i -g npm@^11.6.4