Update to OIDC publishing

.github/workflows/check-published-scheduled.yml

@@ -11,12 +11,16 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@v7
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          node-version: '26.x'
+          package-manager-cache: false
+      - name: Update npm
+        run: npm install --global npm@latest
       - name: Check Published
         uses: checkdigit/github-actions/check-published@main
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN_PUBLISH }}
           DEBUG: '*'
           SLACK_PUBLISH_MISMATCH: ${{ secrets.SLACK_PUBLISH_MISMATCH }}

.github/workflows/ci.yml

@@ -23,12 +23,10 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
+      - name: Update npm
+        run: npm install --global npm@latest
       - name: Install Dependencies
         run: npm ci --ignore-scripts
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      - name: Prepare
-        run: npm run prepare
       - name: Compile
         run: npm run ci:compile
       - name: Check Code Style
@@ -54,12 +52,10 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
+      - name: Update npm
+        run: npm install --global npm@latest
       - name: Install Dependencies
         run: npm ci --ignore-scripts
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      - name: Prepare
-        run: npm run prepare
       - name: Compile
         run: npm run ci:compile
       - name: Check Code Style

.github/workflows/publish.yml

@@ -3,27 +3,71 @@ name: Publish
 on:
   release:
     types: [created]
+  pull_request:
+    branches:
+      - 'main'
 
 jobs:
   publish:
+    name: ${{ github.event_name == 'release' && 'Publish Release' || 'Publish Beta' }}
+    if: >-
+      (github.event_name == 'release' && github.event.action == 'created') ||
+      (github.event_name == 'pull_request' &&
+       github.event.pull_request.base.ref == 'main' &&
+       github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
+    environment: npm-publish
     permissions:
       contents: read
       id-token: write
-    name: Publish to NPM
+      pull-requests: write
     steps:
       - name: Checkout Code
         uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
+      - name: Dependency Review
+        if: github.event_name == 'pull_request'
+        uses: actions/dependency-review-action@v5
+        with:
+          allow-licenses: ${{ vars.ALLOW_LICENSES }}
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
           node-version: '26.x'
+          package-manager-cache: false
           registry-url: 'https://registry.npmjs.org'
+      - name: Update npm
+        run: npm install --global npm@latest
+      - name: Check Label
+        if: github.event_name == 'pull_request'
+        uses: checkdigit/github-actions/check-label@main
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Check Imports
+        if: github.event_name == 'pull_request'
+        uses: checkdigit/github-actions/check-imports@main
       - name: Install Dependencies
         run: npm ci --ignore-scripts
       - name: Audit Signatures
         run: npm audit signatures
-      - name: Publish
-        run: npm publish --provenance
+      - name: Run Test
+        if: github.event_name == 'pull_request'
+        run: npm run ci:test
+      - name: Prepare Beta
+        if: github.event_name == 'pull_request'
+        id: prepare-beta
+        uses: checkdigit/github-actions/prepare-beta@main
+      - name: Publish Release
+        if: github.event_name == 'release'
+        run: npm publish
+      - name: Publish Beta
+        if: github.event_name == 'pull_request'
+        run: npm publish --tag beta
+      - name: Comment npm publish result
+        if: github.event_name == 'pull_request'
+        uses: checkdigit/github-actions/comment-npm-publish@main
+        with:
+          betaPackage: ${{ steps.prepare-beta.outputs.betaPackage }}
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_PUBLISH }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

eslint.config.mjs

@@ -12,7 +12,6 @@ import prettier from 'eslint-config-prettier';
 import json from '@eslint/json';
 import markdown from '@eslint/markdown';
 import yaml from 'eslint-plugin-yml';
-import importPlugin from 'eslint-plugin-import';
 
 const ignores = [
   ...(await fs.readFile('.gitignore', 'utf-8'))
@@ -26,7 +25,6 @@ const tsConfigurations = [
   ...ts.configs.strictTypeChecked,
   ...ts.configs.stylisticTypeChecked,
   prettier,
-  importPlugin.flatConfigs.typescript,
   {
     languageOptions: {
       parser: ts.parser,
@@ -36,12 +34,6 @@ const tsConfigurations = [
         projectService: true,
       },
     },
-    settings: {
-      'import/resolver': {
-        typescript: true,
-        node: true,
-      },
-    },
     rules: {
       'no-shadow': 'off',
       '@typescript-eslint/strict-boolean-expressions': 'error',
@@ -273,7 +265,6 @@ const tsConfigurations = [
           ],
         },
       ],
-      'import/no-extraneous-dependencies': 'off',
       'n/no-process-env': 'off',
       'max-lines': 'off',
       'max-lines-per-function': 'off',