ci: trusted publishing, and build before linting

.github/workflows/build-and-release.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - "**"
 
+  # release on demand, so that a green build is not the same thing as a release
+  workflow_dispatch:
+
 env:
   CI: true
   HUSKY: 0
@@ -20,27 +23,35 @@ jobs:
 
     if: ${{ !contains(github.event.head_commit.message, '[skip-ci]') }}
 
+    permissions:
+      # push the version bump commit and the tag, create the github release
+      contents: write
+      # atomic-release comments on issues and pull requests mentioned in the changelog
+      issues: write
+      pull-requests: write
+      # mint the OIDC token npm exchanges for a short lived publish token
+      id-token: write
+
     runs-on: ubuntu-latest
 
     steps:
       # https://github.com/actions/checkout
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
-          token: ${{ secrets.BOT_PAT }}
           fetch-depth: 0
           persist-credentials: true
 
       # https://github.com/actions/setup-node
       - name: Setup Node.js
         id: setup-node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
 
       # https://github.com/actions/cache
       - name: Cache node_modules
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: npm-cache
         with:
           path: node_modules
@@ -51,9 +62,6 @@ jobs:
         if: steps.npm-cache.outputs.cache-hit != 'true'
         run: npm install
 
-      - name: Lint Code
-        run: npm run lint
-
       # https://commitlint.js.org/guides/ci-setup.html#github-actions
       - name: Lint Commit Messages
         run: |
@@ -66,12 +74,19 @@ jobs:
       - name: Build
         run: npm run build
 
+      # Lint after the build: scripts/release.js imports this package by name, and
+      # the self reference resolves through the exports field into build/, which
+      # does not exist until the build runs. Linting first fails with
+      # n/no-missing-import, which is why every run of this workflow since 2025
+      # has been red.
+      - name: Lint Code
+        run: npm run lint
+
       - name: Test
         run: npm run test
 
       - name: Release
         run: npm run release
         env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           RELEASE_ACTOR: abstracter-bot <bot@abstracter.io>
-          GITHUB_PAT_TOKEN: ${{ secrets.BOT_PAT }}
+          GITHUB_PAT_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.nvmrc

@@ -1 +1 @@
-v18.18.0
+v24.13.0

package.json

@@ -30,7 +30,8 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.org"
+    "registry": "https://registry.npmjs.org",
+    "provenance": true
   },
   "engines": {
     "node": ">=18.16.0"