From e2f468df7cd1d908e28b8250e304b34ccb6b74c4 Mon Sep 17 00:00:00 2001 From: MarcelOlsen Date: Tue, 19 May 2026 21:11:08 +0200 Subject: [PATCH 1/2] chore: bump version to 0.4.0 Co-Authored-By: Claude Sonnet 4.6 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 6cae5c4..ac3004b 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@marcelolsen/mini-react", - "version": "0.3.0", + "version": "0.4.0", "description": "A minimal React implementation with JSX support", "main": "./dist/index.js", "module": "./dist/index.js", From 4ae2da4c42b373bb468817928a54e870f9e6b70b Mon Sep 17 00:00:00 2001 From: MarcelOlsen Date: Tue, 19 May 2026 21:41:36 +0200 Subject: [PATCH 2/2] ci: migrate npm publishing to OIDC trusted publishing Removes the long-lived NPM_TOKEN secret in favour of npm's OIDC trusted publishing. Adds id-token: write permission, a setup-node step to configure the npm registry, and --provenance to the changeset publish command. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/publish.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 0311e01..912d1d8 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -43,6 +43,7 @@ jobs: permissions: contents: write # to create release (changesets/action) pull-requests: write # to create pull request (changesets/action) + id-token: write # to publish to npm via OIDC trusted publishing name: 🚀 Release needs: test runs-on: ubuntu-latest @@ -63,11 +64,16 @@ jobs: - name: 🏗️ Build package run: bun run build + - name: ⚙️ Setup Node for npm registry + uses: actions/setup-node@v4 + with: + node-version: 'lts/*' + registry-url: 'https://registry.npmjs.org' + - name: 🔄 Create Release Pull Request or Publish to NPM id: changesets uses: changesets/action@v1 with: - publish: bunx changeset publish + publish: bunx changeset publish --provenance env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }}