ci: migrate release to npm OIDC trusted publishing (#146)

* ci: migrate release to npm OIDC trusted publishing

* chore(pnpm): migrate config to pnpm v11 format

* ci: run ci and preview workflows on Node 24 for pnpm 11

* fix: lint

Author: bytaesu

.github/workflows/ci.yml

@@ -15,15 +15,15 @@ jobs:
     test:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
               with:
                     fetch-depth: 0
 
-            - uses: pnpm/action-setup@v4
+            - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
-            - uses: actions/setup-node@v4
+            - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
               with:
-                node-version: 20.x
+                node-version-file: '.nvmrc'
                 registry-url: 'https://registry.npmjs.org'
                 cache: pnpm
 

.github/workflows/preview.yml

@@ -14,7 +14,7 @@ jobs:
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 22.x
+          node-version-file: '.nvmrc'
           registry-url: 'https://registry.npmjs.org'
           cache: pnpm
 

.github/workflows/release.yml

@@ -5,34 +5,41 @@ on:
     tags:
       - 'v*'
 
-permissions:
-  contents: write
+permissions: {}
+
+concurrency:
+  group: release-${{ github.ref_name }}
+  cancel-in-progress: false
 
 jobs:
   release:
     runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write
+      id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
-          node-version: 22.x
+          node-version-file: '.nvmrc'
 
       - run: npx changelogithub
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
-            node-version: 22.x
+            node-version-file: '.nvmrc'
             registry-url: 'https://registry.npmjs.org'
 
-      - run: pnpm install
-      
+      - run: pnpm install --frozen-lockfile
+
       - name: Build
         run: pnpm build
 
@@ -59,6 +66,4 @@ jobs:
           echo "Using npm tag: $NPM_TAG"
 
       - name: Publish to npm
-        run: pnpm -r publish --access public --no-git-checks --tag ${{ steps.determine_npm_tag.outputs.npm_tag }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: pnpm -r publish --provenance --access public --no-git-checks --tag ${{ steps.determine_npm_tag.outputs.npm_tag }}

.nvmrc

@@ -0,0 +1 @@
+24

example/package.json

@@ -1,5 +1,6 @@
 {
 	"name": "better-call-example",
+	"private": true,
 	"type": "module",
 	"scripts": {
 		"build": "tsc -b"

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@better-auth/root",
-	"packageManager": "pnpm@10.28.2",
+	"packageManager": "pnpm@11.1.1",
 	"private": true,
 	"scripts": {
 		"build": "pnpm -w --filter=./packages/* run build",

packages/better-call/src/client.ts

@@ -152,4 +152,4 @@ export const createClient = <
 	};
 };
 
-export * from "./error";
+export * from "./error";

pnpm-workspace.yaml

@@ -4,8 +4,8 @@ packages:
 
 blockExoticSubdeps: true
 
-onlyBuiltDependencies:
-  - esbuild
+allowBuilds:
+  esbuild: true
 
 trustPolicy: no-downgrade