enable trusted publishing for npm

.github/workflows/CI-build.yml

@@ -7,9 +7,9 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [18.x]
+        node-version: [24.x]
     env:
-      NODE_OPTIONS: '--max_old_space_size=4096'
+      NODE_OPTIONS: "--max_old_space_size=4096"
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -18,8 +18,8 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: "npm"
+          cache-dependency-path: "**/package-lock.json"
 
       - name: Install dependencies
         run: npm ci

.github/workflows/CI-e2e.yml

@@ -8,10 +8,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [18.x]
+        node-version: [24.x]
         test: [1, 2, 3, 4, 5]
     env:
-      NODE_OPTIONS: '--max_old_space_size=4096'
+      NODE_OPTIONS: "--max_old_space_size=4096"
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -20,8 +20,8 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: "npm"
+          cache-dependency-path: "**/package-lock.json"
 
       - name: Install dependencies
         run: npm ci

.github/workflows/deploy.yml

@@ -7,13 +7,13 @@ on:
       - main
 
 env:
-  NODE_VERSION: 18.x
+  NODE_VERSION: 24.x
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
     env:
-      NODE_OPTIONS: '--max_old_space_size=4096'
+      NODE_OPTIONS: "--max_old_space_size=4096"
     steps:
       - name: Generate Github Token for CI Bot
         uses: actions/create-github-app-token@v1
@@ -31,8 +31,8 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: "npm"
+          cache-dependency-path: "**/package-lock.json"
 
       - name: Install dependencies
         run: npm ci

.github/workflows/i18n-update-pull.yml

@@ -7,7 +7,7 @@ on:
 env:
   LOKALISE_PROJECT_ID: ${{ vars.LOKALISE_PROJECT_ID }}
   LOKALISE_API_TOKEN: ${{ secrets.LOKALISE_API_TOKEN }}
-  NODE_VERSION: 18.x
+  NODE_VERSION: 24.x
   CI: true
 
 jobs:
@@ -91,8 +91,8 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: "npm"
+          cache-dependency-path: "**/package-lock.json"
 
       - name: Install dependencies
         run: npm ci

.github/workflows/i18n-update-push.yml

@@ -7,7 +7,7 @@ on:
 env:
   LOKALISE_PROJECT_ID: ${{ vars.LOKALISE_PROJECT_ID }}
   LOKALISE_API_TOKEN: ${{ secrets.LOKALISE_API_TOKEN }}
-  NODE_VERSION: 18.x
+  NODE_VERSION: 24.x
   CI: true
 
 jobs:
@@ -91,8 +91,8 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: "npm"
+          cache-dependency-path: "**/package-lock.json"
 
       - name: Install dependencies
         run: npm ci
@@ -136,7 +136,7 @@ jobs:
             | **New Branch for i18n** | [\`${process.env.NEW_BRANCH}\`](${branchURL}) |
             | **Last Commit SHA** | ${process.env.LAST_COMMIT_SHA} |
 
-            Maintainers can comment \`.i18n-update-pull\` after translation is done to trigger the i18n pull workflow and pull the changes back to Github. 
+            Maintainers can comment \`.i18n-update-pull\` after translation is done to trigger the i18n pull workflow and pull the changes back to Github.
             `;
 
             github.rest.issues.createComment({

.github/workflows/i18n-update-scheduled.yml

@@ -5,7 +5,7 @@ name: i18n-update-scheduled
 
 on:
   schedule:
-    - cron: '0 0 * * 0'
+    - cron: "0 0 * * 0"
   push:
     branches:
       - develop
@@ -16,7 +16,7 @@ env:
   LOKALISE_API_TOKEN: ${{ secrets.LOKALISE_API_TOKEN }}
   BRANCH: i18n/develop
   LOKALISE_BRANCH: master
-  NODE_VERSION: 18.x
+  NODE_VERSION: 24.x
   CI: true
 
 jobs:
@@ -55,8 +55,8 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: "npm"
+          cache-dependency-path: "**/package-lock.json"
 
       - name: Install dependencies
         run: npm ci

.github/workflows/release.yml

@@ -6,15 +6,19 @@ on:
       - develop
     types: [closed]
 
+permissions:
+  id-token: write # Required for OIDC
+  contents: write
+
 env:
-  NODE_VERSION: 18.x
+  NODE_VERSION: 24.x
 
 jobs:
   release:
     runs-on: ubuntu-latest
     if: github.event.pull_request.merged && startsWith(github.head_ref, 'releases/')
     env:
-      NODE_OPTIONS: '--max_old_space_size=4096'
+      NODE_OPTIONS: "--max_old_space_size=4096"
     steps:
       - name: Generate Github Token for CI Bot
         uses: actions/create-github-app-token@v1
@@ -36,8 +40,12 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: "npm"
+          cache-dependency-path: "**/package-lock.json"
+
+      # Ensure npm 11.5.1 or later is installed (for OIDC)
+      - name: Update npm
+        run: npm install -g npm@11.6.4
 
       - name: Install dependencies
         run: npm ci
@@ -91,12 +99,8 @@ jobs:
 
       - name: Publish SDK to NPM
         if: startsWith(github.head_ref, 'releases/sdk-v')
-        run: |
-          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
-          npm publish --access=public
         working-directory: ./build/sdk
-        env:
-          NPM_TOKEN: ${{secrets.NPM_TOKEN}}
+        run: npm publish --access=public
 
       - name: Create pull request to main (App)
         if: startsWith(github.head_ref, 'releases/v')