v1.2.2 - Trusted Publishing Migration

🔐 Major Update: Trusted Publishing Migration

This release migrates the package from classic npm tokens to OIDC-based Trusted Publishing, significantly improving security and automation.

✨ What's New

• Trusted Publishing (OIDC): No more long-lived npm tokens! Publishing now uses short-lived, automatically-managed credentials from GitHub Actions
• Automatic Provenance: Every package now includes cryptographic proof of its origin and build process
• Enhanced Security: Credentials can't be extracted or leaked, eliminating a major security risk

🔧 Technical Improvements

Workflow Enhancements:

• Added OIDC permissions (id-token: write, contents: read)
• Added release automation permissions (contents: write, pull-requests: write)
• Updated npm to latest version before publishing (required for OIDC support)
• Made auth-token optional in publish action (uses OIDC when not provided)

GitHub Actions Updates:

• Added gpg-key-signing parameter for proper git signing
• Fixed base64 decoding (using printf instead of echo)
• Upgraded artifact actions from v3 to v4 (v3 deprecated)
• Updated Node.js from 16 to 20 (required for npm 11.5+)

Build Configuration:

• Added objectAssign option to buble plugin for ES6 object spread support
• Fixed repository URL case for provenance validation

📦 Published Artifacts

• npm: https://www.npmjs.com/package/@macpaw/browser-deeplink/v/1.2.2
• Provenance: https://search.sigstore.dev/?logIndex=738818305

🔗 Links

• Full Changelog
• npm Trusted Publishing Documentation