From 15b022899c7f762000e33e4f61ca9b7bbfa65e52 Mon Sep 17 00:00:00 2001
From: Elad Chen <3628913+eladchen@users.noreply.github.com>
Date: Sun, 20 Sep 2026 16:35:12 +0300
Subject: [PATCH 1/2] ci: publish to npm with trusted publishing

npm mints a short lived publish token from the workflow's OIDC identity,
so NPM_TOKEN is gone, and the github api calls use GITHUB_TOKEN instead of
the bot PAT. Both expired in August and took the eslint-config release
down with them.

Trusted publishing needs npm 11.5.1 or newer, which needs a modern node,
so .nvmrc moves from v18.18.0 to v24.13.0. engines is untouched.

pull-requests: write sits alongside issues: write because this package's
own GithubCreateIssueCommentsCommand comments on whatever the released
commits reference, and a bare '#12' resolves to a pull request as readily
as an issue. Without the permission the whole release throws and rolls
back, which is what happened on eslint-config 3.0.1.

provenance is set in publishConfig because NpmPublishPackageCommand builds
the publish args itself and has no --provenance option.

Requires a trusted publisher connection for @abstracter/atomic-release on
npmjs.com (abstracter-io / atomic-release / build-and-release.yml, with
'Allow npm publish' ticked) before the next release.
---
 .github/workflows/build-and-release.yml | 22 ++++++++++++++++------
 .nvmrc                                  |  2 +-
 package.json                            |  3 ++-
 3 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml
index fc5dc0e..128e689 100644
--- a/.github/workflows/build-and-release.yml
+++ b/.github/workflows/build-and-release.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - "**"
 
+  # release on demand, so that a green build is not the same thing as a release
+  workflow_dispatch:
+
 env:
   CI: true
   HUSKY: 0
@@ -20,27 +23,35 @@ jobs:
 
     if: ${{ !contains(github.event.head_commit.message, '[skip-ci]') }}
 
+    permissions:
+      # push the version bump commit and the tag, create the github release
+      contents: write
+      # atomic-release comments on issues and pull requests mentioned in the changelog
+      issues: write
+      pull-requests: write
+      # mint the OIDC token npm exchanges for a short lived publish token
+      id-token: write
+
     runs-on: ubuntu-latest
 
     steps:
       # https://github.com/actions/checkout
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
-          token: ${{ secrets.BOT_PAT }}
           fetch-depth: 0
           persist-credentials: true
 
       # https://github.com/actions/setup-node
       - name: Setup Node.js
         id: setup-node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
 
       # https://github.com/actions/cache
       - name: Cache node_modules
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: npm-cache
         with:
           path: node_modules
@@ -72,6 +83,5 @@ jobs:
       - name: Release
         run: npm run release
         env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           RELEASE_ACTOR: abstracter-bot <bot@abstracter.io>
-          GITHUB_PAT_TOKEN: ${{ secrets.BOT_PAT }}
+          GITHUB_PAT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.nvmrc b/.nvmrc
index 6aab9b4..e8416a1 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-v18.18.0
+v24.13.0
diff --git a/package.json b/package.json
index 5561ad2..2136e99 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,8 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.org"
+    "registry": "https://registry.npmjs.org",
+    "provenance": true
   },
   "engines": {
     "node": ">=18.16.0"

From b5a521b8af84aad5fae008fc383d0157fe904b1c Mon Sep 17 00:00:00 2001
From: Elad Chen <3628913+eladchen@users.noreply.github.com>
Date: Sun, 20 Sep 2026 17:10:34 +0300
Subject: [PATCH 2/2] ci: build before linting

scripts/release.js imports this package by name, and that self reference
resolves through the exports field into build/, which does not exist
until the build runs. Linting first fails with

  scripts/release.js:1:21
  Package path . is exported from package ... but no valid target file
  was found  n/no-missing-import

Every run of this workflow since at least September 2025 has been red for
this reason, including the four dependabot pull requests still open.
---
 .github/workflows/build-and-release.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml
index 128e689..e306a66 100644
--- a/.github/workflows/build-and-release.yml
+++ b/.github/workflows/build-and-release.yml
@@ -62,9 +62,6 @@ jobs:
         if: steps.npm-cache.outputs.cache-hit != 'true'
         run: npm install
 
-      - name: Lint Code
-        run: npm run lint
-
       # https://commitlint.js.org/guides/ci-setup.html#github-actions
       - name: Lint Commit Messages
         run: |
@@ -77,6 +74,14 @@ jobs:
       - name: Build
         run: npm run build
 
+      # Lint after the build: scripts/release.js imports this package by name, and
+      # the self reference resolves through the exports field into build/, which
+      # does not exist until the build runs. Linting first fails with
+      # n/no-missing-import, which is why every run of this workflow since 2025
+      # has been red.
+      - name: Lint Code
+        run: npm run lint
+
       - name: Test
         run: npm run test