ci: fix broken install, bump to Node 22/24, publish via OIDC

.github/workflows/cicd-next.yml

@@ -10,16 +10,19 @@ jobs:
   tests:
     strategy:
       matrix:
-        node: [20]
+        node: [22, 24]
     uses: ./.github/workflows/service_tests.yml
     with:
       node-version: ${{ matrix.node }}
-    secrets: inherit
 
   publish:
     needs: [tests]
     name: Publish @next
+    # Reusable workflows can only maintain or reduce the caller's permissions,
+    # never elevate them - so id-token must be granted here for OIDC to work.
+    permissions:
+      id-token: write
+      contents: read
     uses: ./.github/workflows/service_publish.yml
     with:
       tag: next
-    secrets: inherit

.github/workflows/cicd.yml

@@ -10,16 +10,19 @@ jobs:
   tests:
     strategy:
       matrix:
-        node: [20]
+        node: [22, 24]
     uses: ./.github/workflows/service_tests.yml
     with:
       node-version: ${{ matrix.node }}
-    secrets: inherit
 
   publish:
     needs: [tests]
     name: Publish @latest
+    # Reusable workflows can only maintain or reduce the caller's permissions,
+    # never elevate them - so id-token must be granted here for OIDC to work.
+    permissions:
+      id-token: write
+      contents: read
     uses: ./.github/workflows/service_publish.yml
     with:
       tag: latest
-    secrets: inherit

.github/workflows/release-drafter.yml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "main"
-      - uses: release-drafter/release-drafter@v5
+      - uses: release-drafter/release-drafter@v6
         # (Optional) specify config name to use, relative to .github/. Default: release-drafter.yml
         # with:
         #   config-name: my-config.yml

.github/workflows/service_publish.yml

@@ -1,4 +1,4 @@
-name: CI/CD (@next)
+name: Publish
 
 on:
   workflow_call:
@@ -13,55 +13,39 @@ jobs:
     name: Publish to NPM
     runs-on: ubuntu-latest
 
+    permissions:
+      # Required to mint the OIDC token npm exchanges for publish credentials.
+      # The package is configured as a Trusted Publisher on npmjs.org, pinned to
+      # ge-tracker/ge-tracker-api + this workflow file, so no NPM_TOKEN is needed.
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v2
-        with:
-          version: 8
+      # Version comes from the "packageManager" field in package.json.
+      # Trusted publishing requires pnpm >= 11.
+      - uses: pnpm/action-setup@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
           cache: 'pnpm'
 
       # We may have to hoist dependencies to fix TS2742
       # https://github.com/microsoft/TypeScript/issues/47663#issuecomment-1519138189
       # https://github.com/microsoft/TypeScript/issues/47663
       - name: Install dependencies
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
-          mv .npmrc.ci .npmrc
-          echo 'node-linker=hoisted' >> .npmrc
+          echo 'node-linker=hoisted' > .npmrc
           pnpm install --frozen-lockfile
 
       - name: Publish to NPM (@${{ inputs.tag }})
         if: inputs.tag == 'latest'
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: pnpm publish --no-git-checks
 
       - name: Publish tagged to NPM (@${{ inputs.tag }})
         if: inputs.tag != 'latest'
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: pnpm publish --tag ${{ inputs.tag }} --no-git-checks
-#      - name: Publish to NPM (@latest)
-#        # Stop v5 releases being published to @latest
-#        if: ${{ !startsWith(github.ref_name, 'v5.') }}
-#        env:
-#          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-#        run: |
-#          mv .npmrc.ci .npmrc
-#          npm publish
-#
-#      - name: Publish to NPM (@v5)
-#        if: startsWith(github.ref_name, 'v5.')
-#        env:
-#          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-#        run: |
-#          mv .npmrc.ci .npmrc
-#          npm publish --tag v5

.github/workflows/service_tests.yml

@@ -7,7 +7,10 @@ on:
         required: false
         type: number
         description: 'Node.js version to use for the test run'
-        default: 20
+        default: 24
+
+permissions:
+  contents: read
 
 jobs:
   tests:
@@ -18,27 +21,24 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v2
-        with:
-          version: 8
+      # Version comes from the "packageManager" field in package.json
+      - uses: pnpm/action-setup@v6
 
       - name: Setup Node.js ${{ inputs.node-version }}
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
           cache: 'pnpm'
 
       - name: Install dependencies
         run: |
-          mv .npmrc.ci .npmrc
-          echo 'node-linker=hoisted' >> .npmrc
+          echo 'node-linker=hoisted' > .npmrc
           pnpm install --frozen-lockfile
 
-#      - name: Run ESLint
-#        run: pnpm run lint
+      - name: Typecheck
+        run: pnpm run typecheck
 
       - name: Run Tests (Node v${{ inputs.node-version }})
-        run: |
-          pnpm run test --ci
+        run: pnpm run test --ci

.github/workflows/tests.yml

@@ -12,19 +12,28 @@ on:
       - '**.ts'
       - '**.tsx'
       - '**.json'
+      # Changes to CI or install config must validate themselves
+      - '.github/workflows/**'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
   pull_request:
     paths:
       - '**.js'
       - '**.ts'
       - '**.tsx'
       - '**.json'
+      - '.github/workflows/**'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+
+permissions:
+  contents: read
 
 jobs:
   tests:
     strategy:
       matrix:
-        node: [20]
+        node: [22, 24]
     uses: ./.github/workflows/service_tests.yml
     with:
       node-version: ${{ matrix.node }}
-    secrets: inherit

.gitignore

@@ -10,3 +10,4 @@ yarn-error.log*
 .env
 .npm
 test-export.ts
+.npmrc

package.json

@@ -11,19 +11,23 @@
   },
   "scripts": {
     "test": "jest --passWithNoTests",
+    "typecheck": "tsc --noEmit",
     "build": "pnpm run clean && tsup",
-    "clean": "rm -rf dist types",
+    "clean": "rm -rf dist",
     "dev": "tsup src/index.ts --watch --dts",
     "prettier": "prettier --write .",
     "prepublishOnly": "pnpm run build",
     "prepare": "husky install"
   },
   "files": [
     "dist",
-    "types",
     "jest"
   ],
   "type": "commonjs",
+  "packageManager": "pnpm@11.5.1",
+  "engines": {
+    "node": ">=22"
+  },
   "sideEffects": false,
   "source": "./src/index.ts",
   "exports": {
@@ -34,12 +38,12 @@
       "import": "./dist/index.mjs",
       "require": "./dist/index.js"
     },
-    "./types": "./types/index.d.ts",
+    "./types": "./dist/index.d.ts",
     "./jest/jest-mock": "./jest/jest-mock.ts"
   },
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
-  "types": "./types/index.d.ts",
+  "types": "./dist/index.d.ts",
   "dependencies": {
     "axios": "^1.6.2",
     "dayjs": "^1.11.10",
@@ -50,9 +54,9 @@
     "@babel/core": "^7.23.3",
     "@babel/preset-env": "^7.23.3",
     "@babel/preset-typescript": "^7.23.3",
-    "@tsconfig/node20": "^20.1.2",
+    "@tsconfig/node22": "^22.0.5",
     "@types/jest": "^29.5.10",
-    "@types/node": "^20.10.0",
+    "@types/node": "^22.20.1",
     "husky": "^8.0.3",
     "jest": "^29.7.0",
     "lint-staged": "^13.3.0",