DX-809 update to use preferred OIDC for npm publish in github actions

.github/workflows/release.yml

@@ -24,20 +24,27 @@ on:
 jobs:
   npm:
     runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Setup node.js for NPM
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: 14
+          node-version: 20
           cache: 'yarn'
           registry-url: 'https://registry.npmjs.org'
           scope: '@customerio'
 
+      - name: Install npm 11.5.1+ for OIDC support
+        run: npm install -g npm@latest
+
       - name: Install
         run: |
           yarn install --frozen-lockfile
@@ -61,11 +68,13 @@ jobs:
       - name: Build
         run: |
           yarn build
+        env:
+          # Node.js 17+ uses OpenSSL 3.0, and older webpack versions (before 5.95.0) don't support it
+          # This flag allows webpack to work with Node.js 20
+          NODE_OPTIONS: --openssl-legacy-provider
 
       - name: Publish (dry-run)
         if: ${{ github.event.inputs.dry-run == 'true' }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           for package in core browser node; do
             pushd packages/$package
@@ -75,8 +84,6 @@ jobs:
 
       - name: Publish
         if: ${{ github.event.inputs.dry-run == 'false' }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           for package in core browser node; do
             pushd packages/$package
@@ -88,18 +95,18 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Setup node.js for GitHub
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: 14
+          node-version: 20
           cache: 'yarn'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@customerio'
-
+      
       - name: Install
         run: |
           yarn install --frozen-lockfile
@@ -123,11 +130,11 @@ jobs:
       - name: Build
         run: |
           yarn build
+        env:
+          NODE_OPTIONS: --openssl-legacy-provider
 
       - name: Publish (dry-run)
         if: ${{ github.event.inputs.dry-run == 'true' }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           for package in core browser node; do
             pushd packages/$package
@@ -137,8 +144,6 @@ jobs:
 
       - name: Publish
         if: ${{ github.event.inputs.dry-run == 'false' }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           for package in core browser node; do
             pushd packages/$package
@@ -152,43 +157,37 @@ jobs:
     needs: [npm, github]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set Git Identity
         run: |
           git config --global user.name "Customer.io"
           git config --global user.email "win@customer.io"
-
       - name: Install
         run: |
           yarn install --frozen-lockfile
-
       - name: Bump core
         run: |
           cd packages/core
           yarn version ${{ github.event.inputs.version }}
-
       - name: Bump browser
         run: |
           cd packages/browser
           yarn version ${{ github.event.inputs.version }}
           yarn run build-prep
-
       - name: Bump node
         run: |
           cd packages/node
           yarn version ${{ github.event.inputs.version }}
-
       - name: Show commit (dry-run)
         if: ${{ github.event.inputs.dry-run == 'true' }}
         run: |
           git commit -am "Update version"
           git show
-
       - name: Push changes
         if: ${{ github.event.inputs.dry-run == 'false' }}
         run: |
           git commit -am "Update version"
-          git push
+          git push

packages/browser/package.json

@@ -97,7 +97,7 @@
     "terser-webpack-plugin": "^5.1.4",
     "ts-loader": "^9.1.1",
     "ts-node": "^10.8.0",
-    "webpack": "^5.36.1",
+    "webpack": "^5.95.0",
     "webpack-bundle-analyzer": "^4.4.2",
     "webpack-cli": "^4.8.0"
   },

packages/core/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@customerio/cdp-analytics-core",
   "version": "0.3.8",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/customerio/cdp-analytics-js",
+    "directory": "packages/core"
+  },
   "license": "MIT",
   "main": "./dist/cjs/index.js",
   "module": "./dist/esm/index.js",

packages/node/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@customerio/cdp-analytics-node",
   "version": "0.3.8",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/customerio/cdp-analytics-js",
+    "directory": "packages/node"
+  },
   "main": "./dist/cjs/index.js",
   "module": "./dist/esm/index.js",
   "types": "./dist/types/index.d.ts",