TPIP

Remove 'always-auth' setting from setup-node action. #144

	name: TPIP

	on:
	pull_request:
	paths:
	- '.github/workflows/tpip.yml'
	- docs/third-party-licenses.json
	- docs/tpip-header.md
	- scripts/tpip-reporter.ts
	- '!*/.md'
	- '!.github/workflows/markdown.yml'
	- '!.github/markdownlint.json'
	- '!.github/markdownlint.jsonc'
	branches:
	- main
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	report:
	permissions:
	# contents: write # for Git to git push # disabled until resurrecting direct git push
	packages: read

	name: Generate report
	runs-on: ubuntu-latest
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
	with:
	egress-policy: audit

	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	ref: ${{ github.head_ref }}

	- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
	env:
	NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	with:
	node-version: '20'
	registry-url: https://npm.pkg.github.com
	package-manager-cache: false

	- name: Install dependencies
	run: yarn --frozen-lockfile --prefer-offline

	- name: Generate third-party licenses report
	run: yarn run tpip:report

	- name: Commit changes
	if: false
	run: \|
	git config --local user.email "git@github.com"
	git config --local user.name "GitHub Action"
	git add TPIP.md
	git commit -m "Update third-party licenses report [skip ci]"
	git push

Provide feedback