Pre-Prod -> Main - 03/02/2026

.github/workflows/canary-publish.yml

@@ -3,30 +3,33 @@ on:
   workflow_dispatch:
     branches-ignore:
       - main
+
+permissions:
+  id-token: write # Required for OIDC
+  contents: write
+  actions: write
+  attestations: write
+
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
 jobs:
   deploy_canary:
     name: Build And Deploy Canary Release
     runs-on: ubuntu-latest
     environment: canary
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: 'lts/*'
           cache: 'npm'
-
-      - uses: actions/cache@v3
-        id: node-cache
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-
+          registry-url: 'https://registry.npmjs.org'
 
       - run: |
           npm ci --prefer-offline --no-audit
@@ -38,7 +41,6 @@ jobs:
 
       - name: Lerna Publish
         run: |
-          echo "//registry.npmjs.org/:_authToken=${{secrets.NPM_TOKEN}}" > ~/.npmrc
           preId=$(git rev-parse --abbrev-ref HEAD | tr "[:upper:]" "[:lower:]")
           echo "Publishing a canary release..."
           npx lerna publish \

.github/workflows/ci.yml

@@ -4,6 +4,18 @@ on:
   push:
     branches:
       - main
+
+permissions:
+  id-token: write # Required for OIDC
+  contents: write
+  actions: write
+  attestations: write
+  pull-requests: write
+  checks: write
+
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
 jobs:
   test:
     name: Test with Node v${{matrix.node}}
@@ -13,7 +25,7 @@ jobs:
         node: [lts/*, node]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           ref: ${{ github.head_ref || github.ref }}
@@ -24,17 +36,11 @@ jobs:
           fetch-depth: 0
 
       - name: Use Node Version
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           cache: 'npm'
-
-      - uses: actions/cache@v3
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: |
@@ -70,23 +76,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           ref: main
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: 'lts/*'
           cache: 'npm'
-
-      - uses: actions/cache@v3
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: |
@@ -99,7 +99,6 @@ jobs:
 
       - name: Lerna Publish Latest
         run: |
-          echo "//registry.npmjs.org/:_authToken=${{secrets.NPM_TOKEN}}" > ~/.npmrc
           npx lerna publish \
             --conventional-commits \
             --changelog-preset @aabenoja/conventional-changelog-eslint-lerna \
@@ -113,23 +112,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           ref: pre-prod
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: 'lts/*'
           cache: 'npm'
-
-      - uses: actions/cache@v3
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: |
@@ -151,7 +144,6 @@ jobs:
       # (Pre-prod can be ahead of main, but never behind.)
       - name: Lerna Publish Pre-Prod
         run: |
-          echo "//registry.npmjs.org/:_authToken=${{secrets.NPM_TOKEN}}" > ~/.npmrc
           npx lerna publish \
             --conventional-commits \
             --changelog-preset @aabenoja/conventional-changelog-eslint-lerna \
@@ -168,23 +160,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           ref: main
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: 'lts/*'
           cache: 'npm'
-
-      - uses: actions/cache@v3
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: |

.github/workflows/commit-lint.yml

@@ -7,15 +7,16 @@ jobs:
     continue-on-error: true
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: 'lts/*'
           cache: 'npm'
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Ensure full history
         run: |
@@ -33,7 +34,7 @@ jobs:
         run: |
           npm i commander
           npm i @actions/core
-          node ./workflow-helpers/generate-commitlint-response.js --results "$COMMIT_RESPONSE"
+          node ./workflow-helpers/generate-commitlint-response.mjs --results "$COMMIT_RESPONSE"
 
       - name: Post comment
         if: ${{ always() }}

.github/workflows/cypress-ci.yml

@@ -46,7 +46,7 @@ jobs:
 
       - uses: cypress-io/github-action@v6
         with:
-          working-directory: ${{ env.ES_COMPONENTS_DIR }}/cypress
+          working-directory: ${{ env.ES_COMPONENTS_DIR }}
           config-file: cypress.config.ts
           install: false
 

.github/workflows/preprod-ci.yml

@@ -3,30 +3,34 @@ on:
   push:
     branches:
       - pre-prod
+
+permissions:
+  id-token: write # Required for OIDC
+  contents: write
+  actions: write
+  attestations: write
+
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
 jobs:
   pre-prod-release:
     if: ${{ github.ref == 'refs/heads/pre-prod' && !contains(github.event.head_commit.message, '[skip-release]') }}
     name: Publish Pre-Prod NPM Packages
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           ref: pre-prod
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: 'lts/*'
           cache: 'npm'
-
-      - uses: actions/cache@v3
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: |
@@ -39,7 +43,6 @@ jobs:
 
       - name: Lerna Publish
         run: |
-          echo "//registry.npmjs.org/:_authToken=${{secrets.NPM_TOKEN}}" > ~/.npmrc
           npx lerna publish \
             --conventional-commits \
             --changelog-preset @aabenoja/conventional-changelog-eslint-lerna \
@@ -55,23 +58,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.PIPELINE_BOT_PAT }}
           ref: pre-prod
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v6
         with:
           node-version: 'lts/*'
           cache: 'npm'
-
-      - uses: actions/cache@v3
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: |