TPIP

Bump actions/setup-node from 6.3.0 to 6.4.0 #192

	name: TPIP

	on:
	pull_request:
	paths:
	- '.github/workflows/tpip.yml'
	- docs/third-party-licenses.json
	- docs/tpip-header.md
	- scripts/tpip-reporter.ts
	- '!*/.md'
	- '!.github/workflows/markdown.yml'
	- '!.github/markdownlint.json'
	- '!.github/markdownlint.jsonc'
	branches:
	- main
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	report:
	permissions:
	# contents: write # for Git to git push # disabled until resurrecting direct git push
	packages: read

	name: Generate report
	runs-on: ubuntu-latest
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
	with:
	egress-policy: audit

	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	ref: ${{ github.head_ref }}

	- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
	env:
	NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	with:
	node-version-file: package.json
	registry-url: https://npm.pkg.github.com
	package-manager-cache: false

	- name: Install dependencies
	run: npm ci

	- name: Generate third-party licenses report
	run: npm run tpip:report

	- name: Commit changes
	if: false
	run: \|
	git config --local user.email "git@github.com"
	git config --local user.name "GitHub Action"
	git add TPIP.md
	git commit -m "Update third-party licenses report [skip ci]"
	git push

Provide feedback