ci: publish to npm with trusted publishing (OIDC)

.github/workflows/release.yml

@@ -13,7 +13,7 @@
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Set up Node.js
-        uses: labd/gh-actions-typescript/pnpm-install@e7a21fb56b52bf2d91616e34f0bc3f4f9a821b62 # v1.0.0
+        uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0
         with:
           node-version: 22
 
@@ -34,7 +34,7 @@
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Set up Node.js ${{ matrix.node }}
-        uses: labd/gh-actions-typescript/pnpm-install@e7a21fb56b52bf2d91616e34f0bc3f4f9a821b62 # v1.0.0
+        uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0
         with:
           node-version: ${{ matrix.node }}
 
@@ -49,23 +49,36 @@
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main'
     needs: build
+    environment: release
+    permissions:
+      id-token: write # npm trusted publishing (OIDC)
+      contents: write # push version-bump commit + tags
+      pull-requests: write # create/update the release PR
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 
       - name: Set up Node.js
-        uses: labd/gh-actions-typescript/pnpm-install@e7a21fb56b52bf2d91616e34f0bc3f4f9a821b62 # v1.0.0
+        uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0
         with:
           node-version: 22
+          cache: false
+
+      - name: Upgrade npm for trusted publishing
+        run: npm i -g npm@^11.6.4
 
       - name: Create and publish versions
-        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0
+        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
         with:
-          title: "Release new version"
-          commit: "update version"
-          publish: pnpm publish:ci
+          # changesets/action v2 renamed every one of these inputs.
+          pr-title: "Release new version"
+          commit-message: "update version"
+          publish-script: pnpm publish:ci
+          # v2 pushes the release commit and tags through the GitHub API; the
+          # git CLI path keeps the previous behaviour.
+          push-with-git-cli: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true

package.json

@@ -6,7 +6,8 @@
 	"description": "A simple library to parse environment variables",
 	"keywords": [],
 	"publishConfig": {
-		"access": "public"
+		"access": "public",
+		"provenance": true
 	},
 	"type": "module",
 	"main": "index.js",
@@ -22,7 +23,7 @@
 		"dist",
 		"src"
 	],
-	"packageManager": "pnpm@9.15.3",
+	"packageManager": "pnpm@12.12.0",
 	"scripts": {
 		"build": "tsup",
 		"check": "biome check && tsc",
@@ -47,5 +48,9 @@
 		"typescript": "^5.8.3",
 		"vite": "^8",
 		"vitest": "^5.0.5"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/labd/node-enviconf.git"
 	}
 }

pnpm-workspace.yaml

@@ -0,0 +1,29 @@
+minimumReleaseAge: 20160 # 14 days
+# Locked versions younger than 14 days when moving to pnpm 12; drop once they are older (after 2026-11-04).
+minimumReleaseAgeExclude:
+  - "@oxc-project/types@0.155.0"
+  - "@rolldown/binding-android-arm-eabi@1.2.15"
+  - "@rolldown/binding-android-arm64@1.2.15"
+  - "@rolldown/binding-darwin-arm64@1.2.15"
+  - "@rolldown/binding-darwin-x64@1.2.15"
+  - "@rolldown/binding-freebsd-x64@1.2.15"
+  - "@rolldown/binding-linux-arm-gnueabihf@1.2.15"
+  - "@rolldown/binding-linux-arm64-gnu@1.2.15"
+  - "@rolldown/binding-linux-arm64-musl@1.2.15"
+  - "@rolldown/binding-linux-ppc64-gnu@1.2.15"
+  - "@rolldown/binding-linux-s390x-gnu@1.2.15"
+  - "@rolldown/binding-linux-x64-gnu@1.2.15"
+  - "@rolldown/binding-linux-x64-musl@1.2.15"
+  - "@rolldown/binding-openharmony-arm64@1.2.15"
+  - "@rolldown/binding-win32-arm64-msvc@1.2.15"
+  - "@rolldown/binding-win32-x64-msvc@1.2.15"
+  - "@vitest/coverage-v8@5.0.5"
+  - "@vitest/mocker@5.0.5"
+  - "@vitest/spy@5.0.5"
+  - "postcss@8.5.31"
+  - "rolldown@1.2.15"
+  - "vite@8.3.5"
+  - "vitest@5.0.5"
+
+allowBuilds:
+  esbuild: false # postinstall only verifies the platform binary; was already skipped under pnpm 9