Chore/npm security update

.github/workflows/release.yml

@@ -1,28 +1,38 @@
 name: Build & Publish NPM Package
-description: This workflow builds and publishes the NPM package when a version tag is pushed.
+description: Build and publish to npm (prod/dev) using Trusted Publishers.
 
 on:
   push:
     tags:
-      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v*.*.*'          # prod releases, e.g. v1.2.3
+      - 'v*.*.*-dev.*'    # dev releases, e.g. v1.2.3-dev.4
 
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write   # Required for npm Trusted Publishers (OIDC)
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 'lts/*'
 
       - name: Install dependencies
         run: npm install
 
       - name: Build package
         run: npm run build
 
-      - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          # for public packages, include --access public
-          npm publish --access public
+      - name: Publish dev tag to npm (Trusted Publishers)
+        if: contains(github.ref_name, '-dev.')
+        run: npm publish --provenance --access public --tag dev
+
+      - name: Publish latest to npm (Trusted Publishers)
+        if: ${{ !contains(github.ref_name, '-dev.') }}
+        run: npm publish --provenance --access public

package.json

@@ -2,6 +2,10 @@
   "name": "@gisatcz/ptr-be-core",
   "version": "0.0.1",
   "description": "Shared core library for PTR BE services",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Gisat/ptr-be-core.git"
+  },
   "type": "module",
   "files": [
     "dist/"