chore: OIDC publishing (#10)

* chore: id-token for oidc publishing

* chore: provenance

* refactor: mv permissions to the jb block

* chore: add test branch for oidc

* feat: test oidc publishing

* chore: remove npm token for oidc

* chore: split semantic-release and npm publish for oidc

* chore: use npm token for read, oidc for publish

* chore: upgrade to node 23 for npm 11 oidc support

* chore: upgrade npm to 11 for oidc support

* chore: upgrade node to 22.12 for npm 11 compat

* chore: remove provenance flag for private package

* feat: upgrade semantic-release/npm to 13.1.3 for oidc support

* chore: regen lock

* chore: upgrade semantic-release to 25 for oidc support

* feat: verify oidc publishing with semantic-release 25

* chore: upgrade node to 22.14 for semantic-release 25

* chore: clean up releaserc

---------

Co-authored-by: exo-mv <mark@exodus.io>

Author: mvayngrib

.github/workflows/build-npm.yml

@@ -1,5 +1,6 @@
 name: Create a release
 on: workflow_dispatch
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -8,10 +9,9 @@ jobs:
       contents: write # to be able to publish a GitHub release
       issues: write # to be able to comment on released issues
       pull-requests: write # to be able to comment on released pull requests
-      # id-token: write # to enable use of OIDC for npm provenance
+      id-token: write # to enable use of OIDC for npm provenance
     env:
       WORKING_DIRECTORY: ./
-      INPUT_TOKEN: ${{ secrets.NPM_TOKEN }}
     concurrency:
       group: npm-${{ github.ref }}
       cancel-in-progress: true
@@ -29,11 +29,11 @@ jobs:
       - name: Build package and documentation
         run: yarn build
 
-      - name: Build NPM Package
+      - name: Upgrade npm for OIDC support
+        run: npm install -g npm@11
+
+      - name: Semantic Release
         working-directory: packages/skia
-        run: |
-          yarn release
+        run: yarn release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: false

.nvmrc

@@ -1 +1 @@
-v22.3.0
+v22.14.0

packages/skia/.releaserc

@@ -1,19 +1,12 @@
 {
   "branches": [
     "main",
-    {
-      "name": "exodus-2.0.1",
-      "prerelease": "rc"
-    }
+    { "name": "exodus-2.0.1", "prerelease": "rc" }
   ],
   "plugins": [
     "@semantic-release/commit-analyzer",
     "@semantic-release/release-notes-generator",
-    [
-      "@semantic-release/npm"
-    ],
-    [
-       "@semantic-release/github"
-    ]
+    "@semantic-release/npm",
+    "@semantic-release/github"
   ]
 }

packages/skia/package.json

@@ -114,7 +114,7 @@
     "react-native-builder-bob": "0.18.2",
     "react-native-reanimated": "^3.0",
     "rimraf": "3.0.2",
-    "semantic-release": "^24.1.0",
+    "semantic-release": "^25.0.2",
     "ts-jest": "29.1.1",
     "ts-node": "^10.9.2",
     "typescript": "^5.2.2",