Fixing workflows to work with latest token

.github/workflows/canary-publish.yml

@@ -3,30 +3,33 @@ on:
   workflow_dispatch:
     branches-ignore:
       - main
+
+permissions:
+  id-token: write # Required for OIDC
+  contents: write
+  actions: write
+  attestations: write
+
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
 jobs:
   deploy_canary:
     name: Build And Deploy Canary Release
     runs-on: ubuntu-latest
     environment: canary
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: 'lts/*'
           cache: 'npm'
-
-      - uses: actions/cache@v3
-        id: node-cache
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-
+          registry-url: 'https://registry.npmjs.org'
 
       - run: |
           npm ci --prefer-offline --no-audit
@@ -38,7 +41,6 @@ jobs:
 
       - name: Lerna Publish
         run: |
-          echo "//registry.npmjs.org/:_authToken=${{secrets.NPM_TOKEN}}" > ~/.npmrc
           preId=$(git rev-parse --abbrev-ref HEAD | tr "[:upper:]" "[:lower:]")
           echo "Publishing a canary release..."
           npx lerna publish \

.github/workflows/ci.yml

@@ -4,6 +4,16 @@ on:
   push:
     branches:
       - main
+
+permissions:
+  id-token: write # Required for OIDC
+  contents: write
+  actions: write
+  attestations: write
+
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
 jobs:
   test:
     name: Test with Node v${{matrix.node}}
@@ -13,7 +23,7 @@ jobs:
         node: [lts/*, node]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           ref: ${{ github.head_ref || github.ref }}
@@ -24,17 +34,11 @@ jobs:
           fetch-depth: 0
 
       - name: Use Node Version
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           cache: 'npm'
-
-      - uses: actions/cache@v3
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: |
@@ -70,23 +74,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           ref: main
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: 'lts/*'
           cache: 'npm'
-
-      - uses: actions/cache@v3
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: |
@@ -99,7 +97,6 @@ jobs:
 
       - name: Lerna Publish Latest
         run: |
-          echo "//registry.npmjs.org/:_authToken=${{secrets.NPM_TOKEN}}" > ~/.npmrc
           npx lerna publish \
             --conventional-commits \
             --changelog-preset @aabenoja/conventional-changelog-eslint-lerna \
@@ -113,23 +110,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           ref: pre-prod
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: 'lts/*'
           cache: 'npm'
-
-      - uses: actions/cache@v3
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: |
@@ -151,7 +142,6 @@ jobs:
       # (Pre-prod can be ahead of main, but never behind.)
       - name: Lerna Publish Pre-Prod
         run: |
-          echo "//registry.npmjs.org/:_authToken=${{secrets.NPM_TOKEN}}" > ~/.npmrc
           npx lerna publish \
             --conventional-commits \
             --changelog-preset @aabenoja/conventional-changelog-eslint-lerna \
@@ -168,23 +158,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           ref: main
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: 'lts/*'
           cache: 'npm'
-
-      - uses: actions/cache@v3
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: |

.github/workflows/commit-lint.yml

@@ -7,15 +7,16 @@ jobs:
     continue-on-error: true
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: 'lts/*'
           cache: 'npm'
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Ensure full history
         run: |

.github/workflows/preprod-ci.yml

@@ -10,6 +10,9 @@ permissions:
   actions: write
   attestations: write
 
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
 jobs:
   pre-prod-release:
     if: ${{ github.ref == 'refs/heads/pre-prod' && !contains(github.event.head_commit.message, '[skip-release]') }}
@@ -40,7 +43,6 @@ jobs:
 
       - name: Lerna Publish
         run: |
-          echo "//registry.npmjs.org/:_authToken=${{secrets.NPM_TOKEN}}" > ~/.npmrc
           npx lerna publish \
             --conventional-commits \
             --changelog-preset @aabenoja/conventional-changelog-eslint-lerna \

lerna.json

@@ -1,10 +1,10 @@
 {
-  "lerna": "2.11.0",
   "packages": ["packages/*"],
   "version": "21.15.2-pre-prod.8",
   "command": {
     "publish": {
       "message": "Build: [skip ci][skip-release] %s"
     }
-  }
+  },
+  "$schema": "node_modules/lerna/schemas/lerna-schema.json"
 }