fix(release): add OIDC permissions, pin action versions, fix exports warnings

[GaneshPatil7517]

Fixes the remaining release failures reported in #851 after the ESLint fix in #860.

Changes

1. Fix E404 npm publish failure

• Pin GitHub Actions versions: Changed actions/checkout and actions/setup-node from @main to @v4. Using @main is dangerous the main branch can introduce breaking changes at any time. The setup-node@main change is the most likely cause of the E404, as it may have altered .npmrc generation or auth token resolution.

• Add OIDC permissions: Added top-level permissions block with contents: write (for git push and GitHub release creation) and id-token: write (for lerna 9's OIDC trusted publishing support). Lerna 9.0.0 introduced OIDC trusted publishing which works automatically when the id-token: write permission is available.

• Update Docker action versions: docker/login-action v2→v3, docker/setup-buildx-action v2→v3, docker/build-push-action v3→v6.

2. Fix ng-packagr 20 export warnings

Removed conflicting ./package.json and . entries from phoenix-ui-components/package.json exports. ng-packagr 20 auto-generates these entries in dist/package.json, and the manual entries in the source package.json caused build warnings. The module and typings fields still provide correct resolution for bundlers and TypeScript. Only the custom ./theming Sass export is retained.

⚠️ Important: Verify NPM_TOKEN

The last successful npm publish was Nov 30, 2024 using lerna 8.1.9. If the NPM_TOKEN repository secret is a granular access token with an expiration date, it may have expired. Please verify at https://www.npmjs.com/settings/~/tokens.

Closes #851

[Copilot]

Pull request overview

This PR aims to resolve outstanding release workflow failures (per #851) by hardening the GitHub Actions release pipeline configuration and adjusting Angular package export metadata to eliminate ng-packagr export warnings.

Changes:

• Add workflow-level GitHub token permissions (contents: write, id-token: write) to support release publishing (including OIDC).
• Pin GitHub Actions used in the release workflow to stable major versions and bump Docker action major versions.
• Remove exports entries from phoenix-ui-components that were conflicting with ng-packagr-generated metadata, retaining only the Sass theming subpath.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/release.yml	Adds explicit permissions and pins/updates action versions for release + Docker publishing.
packages/phoenix-ng/projects/phoenix-ui-components/package.json	Adjusts exports to reduce ng-packagr export warnings while keeping the Sass theming export.

Comments suppressed due to low confidence (1)

packages/phoenix-ng/projects/phoenix-ui-components/package.json:50

• exports now only defines ./theming. When a package.json contains an exports map but no "." entry, consumers cannot import the package root (e.g. import ... from 'phoenix-ui-components') because the default entrypoint is not exported. If the intent is to rely on ng-packagr’s generated exports, note this package publishes from the project root (and even deletes dist/package.json in prepublishOnly), so the generated dist/package.json exports won’t be used by Node/bundlers. Consider restoring the "." export (and optionally ./package.json) or removing the exports field entirely and using another mechanism for the Sass entrypoint.

  "exports": {
    "./theming": {
      "sass": "./_theming.scss"
    }
  }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.