feat(TU-33147): Migrate to OIDC Authentication

.github/workflows/pr.yml

@@ -11,8 +11,7 @@ jobs:
     strategy:
       matrix:
         node_version:
-          - 18 # end of life 2025-04-30
-          - 20 # end of life 2025-04-30 # please update "Upload coverage file" step if you change this
+          - 22 # end of life 2027-04-30 # coverage file uploaded from this version
     name: build-lint-test - node ${{ matrix.node_version }}
     steps:
       - name: Check out Git repository
@@ -57,7 +56,6 @@ jobs:
 
       - name: Upload coverage file
         uses: actions/upload-artifact@v4
-        if: ${{ matrix.node_version == '20' }}
         with:
           name: coverage-report
           path: ./coverage/lcov.info

.github/workflows/release.yml

@@ -10,14 +10,17 @@ jobs:
   release:
     name: release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - name: Check out Git repository
         uses: actions/checkout@v3
 
       - name: Set up Node.js
         uses: actions/setup-node@v3
         with:
-          node-version: 20
+          node-version: 22
 
       - name: Get yarn cache
         uses: actions/cache@v3
@@ -35,9 +38,8 @@ jobs:
       - name: Build
         run: yarn build
 
-      # update registry and tokens with write access for releasing.
+      # Configure registry for GitHub Packages
       - run: rm ./.npmrc
-      - run: npm config set '//registry.npmjs.org/:_authToken' $NPM_TOKEN
       - run: npm config set '//npm.pkg.github.com/:_authToken' $GH_TOKEN
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN }}
@@ -46,5 +48,4 @@ jobs:
         if: ${{ contains(github.ref, 'refs/heads/main') || contains(github.ref, 'refs/heads/beta') }}
         run: yarn release
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}

.releaserc

@@ -21,7 +21,10 @@
         "noteKeywords": ["BREAKING CHANGE", "BREAKING CHANGES"]
       }
     }],
-    "@semantic-release/npm",
+    ["@semantic-release/npm", {
+      "npmPublish": true,
+      "provenance": true
+    }],
     ["@semantic-release/exec", {
       "successCmd": "yarn publish:github"
     }],

package.json

@@ -65,7 +65,7 @@
     "@semantic-release/commit-analyzer": "^11.1.0",
     "@semantic-release/exec": "^6.0.3",
     "@semantic-release/github": "^9.2.4",
-    "@semantic-release/npm": "^11.0.1",
+    "@semantic-release/npm": "^13.1.1",
     "@typeform/eslint-config": "^6.0.3",
     "@types/jest": "^24.0.18",
     "axios-mock-adapter": "^1.22.0",