From f4d96430e90ef4709731082055573c7d0f00ecf2 Mon Sep 17 00:00:00 2001 From: Wes Cossick Date: Tue, 2 Dec 2025 15:50:57 -0600 Subject: [PATCH 1/5] Use trusted publishing for npm package https://docs.npmjs.com/trusted-publishers --- .github/workflows/main.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 6564f1a..46be298 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -13,6 +13,10 @@ on: branches: - master +permissions: + id-token: write + contents: read + jobs: lint: name: Lint code From 907064eab8c2c6fe1600178dae3b72e2c4cbcfab Mon Sep 17 00:00:00 2001 From: Wes Cossick Date: Tue, 2 Dec 2025 16:01:57 -0600 Subject: [PATCH 2/5] Limit permissions --- .github/workflows/main.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 46be298..518d6af 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -13,10 +13,6 @@ on: branches: - master -permissions: - id-token: write - contents: read - jobs: lint: name: Lint code @@ -95,6 +91,9 @@ jobs: - test - verify-website if: github.event_name == 'push' && contains(github.ref, 'refs/tags/') + permissions: + id-token: write + contents: read steps: - uses: actions/checkout@v3 - name: Use Node.js From 18c7aba78f8a4d224e37a8ec5e010a1dd779217d Mon Sep 17 00:00:00 2001 From: Wes Cossick Date: Tue, 2 Dec 2025 16:04:54 -0600 Subject: [PATCH 3/5] Remove environment variable and switch to `npm publish` --- .github/workflows/main.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 518d6af..d866b85 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -112,9 +112,7 @@ jobs: restore-keys: | ${{ runner.os }}-yarn- - run: yarn dev - - run: yarn publish - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + - run: npm publish deploy: name: Deploy to GitHub Pages runs-on: ubuntu-latest From 6428739d231e056bf5fa0d2298c973b8fb286da6 Mon Sep 17 00:00:00 2001 From: Wes Cossick Date: Tue, 2 Dec 2025 16:19:49 -0600 Subject: [PATCH 4/5] Use correct alpha/beta tag with `npm publish` --- .github/workflows/main.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index d866b85..ea452f0 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -112,7 +112,14 @@ jobs: restore-keys: | ${{ runner.os }}-yarn- - run: yarn dev - - run: npm publish + - run: | + if [[ "$GITHUB_REF" =~ -alpha ]]; then + npm publish --tag alpha + elif [[ "$GITHUB_REF" =~ -beta ]]; then + npm publish --tag beta + else + npm publish + fi deploy: name: Deploy to GitHub Pages runs-on: ubuntu-latest From 4397f15059f70edc83b146e1d80b5b22099109b2 Mon Sep 17 00:00:00 2001 From: Wes Cossick Date: Tue, 2 Dec 2025 16:24:50 -0600 Subject: [PATCH 5/5] Bump the patch version --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 658f6c9..ac5da76 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "react-accessible-dropdown-menu-hook", - "version": "4.0.0", + "version": "4.0.1", "description": "A simple Hook for creating fully accessible dropdown menus in React", "main": "dist/use-dropdown-menu.js", "types": "dist/use-dropdown-menu.d.ts",