chore: use OIDC to authenticate against the npm registry

.github/workflows/ci.yml

@@ -6,8 +6,7 @@ on:
 
 jobs:
   block-autosquash:
-    # bypass the action if the PR is a draft
-    if: github.event.pull_request.draft == false
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == false }}
     name: block-autosquash
     runs-on: ubuntu-latest
     steps:
@@ -75,14 +74,21 @@ jobs:
         run: npm run test
 
   test-deno:
+    needs: build
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        deno: ['v1.x']
+        deno: ['v1.x', 'v2.x']
     name: test:deno(${{ matrix.deno }})
     steps:
       - uses: actions/checkout@v4
 
+      - uses: actions/cache@v4
+        id: npm-cache
+        with:
+          path: '**/node_modules'
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json', '.nvmrc') }}
+
       - uses: denoland/setup-deno@v1
         with:
           deno-version: ${{ matrix.deno }}

.github/workflows/release.yml

@@ -5,8 +5,13 @@ on:
     branches:
       - main
 
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
 jobs:
   release:
+    name: Release
     runs-on: ubuntu-latest
 
     steps:
@@ -19,6 +24,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: npm ci
@@ -30,4 +36,3 @@ jobs:
           commit: 'chore: version packages'
         env:
           GITHUB_TOKEN: ${{ secrets.CHANGESET_RELEASE_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.nvmrc

@@ -1 +1 @@
-v20
+24