use npm provenance (OIDC)

.github/workflows/ci-test-publish.yml

@@ -19,16 +19,24 @@ on:
         required: false
         default: false
 
+permissions:
+  actions: read
+  contents: read
+  pull-requests: read
+  # Required for npm provenance (OIDC)
+  id-token: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5.0.0
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6.0.0
         with:
-          node-version: 18
+          node-version: 24
+          registry-url: 'https://registry.npmjs.org'
       - run: npm ci
       - run: npm run lint
       - run: npm run prettier:ci
@@ -40,10 +48,7 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
       - name: npm publish
         if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '.') }}
-        uses: JS-DevTools/npm-publish@v3
-        with:
-          access: public
-          token: ${{ secrets.NPM_TOKEN }}
+        uses: JS-DevTools/npm-publish@v4.1.1
 
       # Enable tmate debugging of manually-triggered workflows if the input option was provided
       - name: Setup tmate session

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sillsdev/scripture",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "TypeScript partial port of `libpalaso/SIL.Scripture`",
   "main": "dist/index.cjs.js",
   "module": "dist/index.es.js",
@@ -57,9 +57,13 @@
     "ts-node": "^10.9.2",
     "tslib": "^2.8.1",
     "typescript": "^5.4.5",
-    "vite": "^6.3.4"
+    "vite": "^6.4.1"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
   },
   "volta": {
-    "node": "18.20.3"
+    "node": "24.11.0"
   }
 }