Migrate npm publishing to trusted publishers with yarn 4 and Node 22 (#109)

* Initial plan

* Implement npm trusted publishing support

- Update all actions/setup-node to v6
- Add npm 11.5.1 installation for trusted publishers support
- Add workflow permissions (id-token: write, contents: read, packages: write)
- Remove NPM_TOKEN authentication from npm publishing (use trusted publishing)
- Set NODE_AUTH_TOKEN="" for npm publish
- Bump typescript package version from 1.4.2 to 1.4.3
- Keep NPM_TOKEN for GitHub packages publishing

Co-authored-by: dmattia <8922077+dmattia@users.noreply.github.com>

* Address code review feedback

- Add registry-url to setup-node for npm trusted publishing
- Remove unnecessary NODE_AUTH_TOKEN environment variable

Co-authored-by: dmattia <8922077+dmattia@users.noreply.github.com>

* Run pre-commit hooks: update table of contents in python/README.md

Co-authored-by: dmattia <8922077+dmattia@users.noreply.github.com>

* Bump pre-commit action from v2.0.2 to v4.0.0

Fixes GitHub Actions cache service errors in the run-pre-commits job

Co-authored-by: dmattia <8922077+dmattia@users.noreply.github.com>

* Fix pre-commit action version to v3.0.0

v4.0.0 doesn't exist, using v3.0.0 instead

Co-authored-by: dmattia <8922077+dmattia@users.noreply.github.com>

* Update to yarn 4.12.0, Node 22, and add provenance to npm publish

- Run yarn set version 4.12.0
- Update all CI jobs to use Node.js 22.x instead of 14.x
- Add --provenance flag to npm publish for attestation
- GitHub packages publish remains without provenance flag

Co-authored-by: dmattia <8922077+dmattia@users.noreply.github.com>

* bump yarn and node version

* bump yarn version

* remove unneeded thing with yarn

* run yarn

* run yarn

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: dmattia <8922077+dmattia@users.noreply.github.com>
Co-authored-by: David Mattia <david@transcend.io>

Author: Copilot

.devcontainer/Dockerfile

@@ -1,8 +1,8 @@
 # See here for image contents: https://github.com/microsoft/vscode-dev-containers/tree/v0.233.0/containers/typescript-node/.devcontainer/base.Dockerfile
 
 # [Choice] Node.js version (use -bullseye variants on local arm64/Apple Silicon): 18, 16, 14, 18-bullseye, 16-bullseye, 14-bullseye, 18-buster, 16-buster, 14-buster
-ARG VARIANT="18-bullseye"
-FROM mcr.microsoft.com/vscode/devcontainers/typescript-node:0-${VARIANT}
+ARG VARIANT="22-bullseye"
+FROM mcr.microsoft.com/vscode/devcontainers/typescript-node:${VARIANT}
 
 # [Optional] Uncomment this section to install additional OS packages.
 # RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \

.devcontainer/devcontainer.json

@@ -8,7 +8,7 @@
     // Append -bullseye or -buster to pin to an OS version.
     // Use -bullseye variants on local on arm64/Apple Silicon.
     "args": {
-      "VARIANT": "16-bullseye"
+      "VARIANT": "22-bullseye"
     }
   },
 

.github/workflows/ci.yml

@@ -1,15 +1,20 @@
 name: ci
 on: push
 
+permissions:
+  id-token: write
+  contents: read
+  packages: write
+
 jobs:
   run-depcheck:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - name: Use Node.js 14.x
-        uses: actions/setup-node@v1
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@v6
         with:
-          node-version: 14.x
+          node-version: 22.x
       - run: yarn install --immutable
       - run: yarn depcheck
 
@@ -20,23 +25,23 @@ jobs:
         with:
           fetch-depth: 100 # need the history to do a changed files check below (source, origin)
       - uses: actions/setup-python@v2
-      - name: Use Node.js 14.x
-        uses: actions/setup-node@v1
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@v6
         with:
-          node-version: 14.x
+          node-version: 22.x
       - run: yarn install --immutable
-      - uses: pre-commit/action@v2.0.2
+      - uses: pre-commit/action@v3.0.0
         with:
           extra_args: --source ${{ github.event.pull_request.base.sha || 'HEAD~1' }} --origin ${{ github.event.pull_request.head.sha || 'HEAD' }}
 
   build-and-upload-artifacts:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - name: Use Node.js 14.x
-        uses: actions/setup-node@v1
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@v6
         with:
-          node-version: 14.x
+          node-version: 22.x
       - run: yarn install --immutable
       - name: Build the typescript code
         run: cd typescript && yarn && yarn build
@@ -55,15 +60,12 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@v6
         with:
-          node-version: '14.x'
-      - name: Configure NPM authentication
-        run: |
-          yarn config set npmAlwaysAuth true
-          yarn config set npmAuthToken ${{ secrets.NPM_TOKEN }}
+          node-version: '22.x'
+          registry-url: 'https://registry.npmjs.org'
       - name: Publish to yarn/npm
-        run: yarn && cd typescript && yarn npm publish
+        run: yarn && cd typescript && yarn npm publish --provenance
 
   build-to-github-packages:
     if: github.ref == 'refs/heads/main'
@@ -75,9 +77,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@v6
         with:
-          node-version: '14.x'
+          node-version: '22.x'
       - name: Install dependencies
         run: yarn
       - name: Configure Github Packages authentication

.vscode/settings.json

@@ -34,7 +34,7 @@
     "**/.pnp.*": true
   },
   "editor.codeActionsOnSave": {
-    "source.fixAll": true
+    "source.fixAll": "explicit"
   },
   "cSpell.words": [
     "Blocklist",

.yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs

@@ -1,9 +1,7 @@
-npmPublishAccess: public
+compressionLevel: mixed
+
+enableGlobalCache: false
 
-plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
-    spec: "@yarnpkg/plugin-interactive-tools"
-  - path: .yarn/plugins/@yarnpkg/plugin-typescript.cjs
-    spec: "@yarnpkg/plugin-typescript"
+npmPublishAccess: public
 
-yarnPath: .yarn/releases/yarn-3.2.0.cjs
+yarnPath: .yarn/releases/yarn-4.12.0.cjs

.yarn/plugins/@yarnpkg/plugin-typescript.cjs

@@ -37,5 +37,5 @@
     "prettier": "^2.5.1",
     "typescript": "^4.6.3"
   },
-  "packageManager": "yarn@3.2.0"
+  "packageManager": "yarn@4.12.0"
 }