update to Node.js 24.18.1 and setup trusted publishing (#8291)

Author: n1ru4l

.changeset/odd-weeks-trade.md

@@ -0,0 +1,5 @@
+---
+'hive': patch
+---
+
+Update to Node.js `24.18.1`.

.changeset/upset-lizards-tie.md

@@ -0,0 +1,13 @@
+---
+'@graphql-hive/apollo': patch
+'@graphql-hive/cli': patch
+'@graphql-hive/core': patch
+'@graphql-hive/envelop': patch
+'@graphql-hive/external-composition': patch
+'@graphql-hive/gateway-plugin-console-sdk': patch
+'@graphql-hive/laboratory': patch
+'@graphql-hive/render-laboratory': patch
+'@graphql-hive/yoga': patch
+---
+
+Use npm trusted publishing.

.github/actions/setup/action.yml

@@ -28,24 +28,17 @@ runs:
       env:
         INSTALL_DEPENDENCIES: ${{ inputs.installDependencies }}
       run: |
-        PNPM_VERSION=$(cat package.json | jq -r '.packageManager' | awk -F@ '{print $2}')
-        PNPM_VERSION=${PNPM_VERSION:-9}
-        echo "Using PNPM version $PNPM_VERSION"
-        echo "version=$PNPM_VERSION" >> $GITHUB_OUTPUT
-
         if [ $INSTALL_DEPENDENCIES = true ]; then
           echo "cache=pnpm" >> $GITHUB_OUTPUT
         else
           echo "cache=" >> $GITHUB_OUTPUT
         fi
 
     - name: install pnpm
-      uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0
-      with:
-        version: ${{ steps.pnpm.outputs.version }}
+      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
     - name: install nodejs
-      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version-file: .node-version
         cache: ${{ steps.pnpm.outputs.cache }}

.github/workflows/build-and-dockerize.yaml

@@ -175,6 +175,11 @@ jobs:
               echo "sha_short=${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT
           fi
 
+      - name: configure Docker Node.js image tag
+        id: node-version-tag
+        if: ${{ inputs.dockerize }}
+        run: echo "value=:$(< .node-version)-slim" >> "$GITHUB_OUTPUT"
+
       - name: build docker images (${{ matrix.platform }})
         timeout-minutes: 60
         id: docker-bake
@@ -191,6 +196,7 @@ jobs:
           BUILD_STABLE: ${{ inputs.publishLatest && '1' || '' }}
           BUILD_PLATFORM: ${{ matrix.platform }}
           IMAGE_SUFFIX: ${{ matrix.suffix }}
+          NODE_VERSION_TAG: ${{ steps.node-version-tag.outputs.value }}
         with:
           # See https://github.com/docker/buildx/issues/1533
           provenance: false
@@ -237,6 +243,10 @@ jobs:
         with:
           fetch-depth: 2
 
+      - name: configure Docker Node.js image tag
+        id: node-version-tag
+        run: echo "value=:$(< .node-version)-slim" >> "$GITHUB_OUTPUT"
+
       - name: configure docker buildx
         uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
 
@@ -254,6 +264,7 @@ jobs:
           REGISTRY: ${{ inputs.registry }}
           IMAGE_NAME: ${{ inputs.imageName }}
           IMAGE_TAG: ${{ inputs.imageTag }}
+          NODE_VERSION_TAG: ${{ steps.node-version-tag.outputs.value }}
         run: |
           targets=$(docker buildx bake -f docker/docker.hcl --print "$TARGETS" | jq -r '.group."'"$TARGETS"'".targets[]')
 
@@ -284,6 +295,7 @@ jobs:
           REGISTRY: ${{ inputs.registry }}
           IMAGE_NAME: ${{ inputs.imageName }}
           IMAGE_TAG: ${{ steps.git_hash.outputs.sha_short }}
+          NODE_VERSION_TAG: ${{ steps.node-version-tag.outputs.value }}
         run: |
           targets=$(docker buildx bake -f docker/docker.hcl --print "$TARGETS" | jq -r '.group."'"$TARGETS"'".targets[]')
 
@@ -308,6 +320,7 @@ jobs:
           SHA_SHORT: ${{ steps.git_hash.outputs.sha_short }}
           RELEASE_STAGE: ${{ inputs.publishLatest == false && 'alpha-' || '' }}
           LATEST_VERSION: ${{ inputs.latestVersion }}
+          NODE_VERSION_TAG: ${{ steps.node-version-tag.outputs.value }}
         run: |
           targets=$(docker buildx bake -f docker/docker.hcl --print "$TARGETS" | jq -r '.group."'"$TARGETS"'".targets[]')
 
@@ -328,6 +341,7 @@ jobs:
           TARGETS: ${{ inputs.targets }}
           REGISTRY: ${{ inputs.registry }}
           IMAGE_NAME: ${{ inputs.imageName }}
+          NODE_VERSION_TAG: ${{ steps.node-version-tag.outputs.value }}
         run: |
           targets=$(docker buildx bake -f docker/docker.hcl --print "$TARGETS" | jq -r '.group."'"$TARGETS"'".targets[]')
 

.github/workflows/dockerize-cli.yaml

@@ -27,6 +27,9 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 2
+      - name: configure Docker Node.js image tag
+        id: node-version-tag
+        run: echo "value=:$(< .node-version)-slim" >> "$GITHUB_OUTPUT"
       - name: configure eqemu
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
         with:
@@ -42,6 +45,8 @@ jobs:
 
       - name: Prepare Bake inputs
         id: docker-bake-inputs
+        env:
+          NODE_VERSION_TAG: ${{ steps.node-version-tag.outputs.value }}
         run: |
           targets=$(docker buildx bake -f docker/docker.hcl --print build | jq -r '.group.build.targets[]')
           input_set=""
@@ -68,6 +73,7 @@ jobs:
           BUILD_TYPE: 'publish'
           PWD: ${{ github.workspace }}
           BUILD_STABLE: ${{ inputs.publishLatest && '1' || '' }}
+          NODE_VERSION_TAG: ${{ steps.node-version-tag.outputs.value }}
         with:
           # See https://github.com/docker/buildx/issues/1533
           provenance: false

.github/workflows/main.yaml

@@ -9,73 +9,6 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  # Release NPM packages and tarballs
-  package:
-    uses: ./.github/workflows/release-stable.yaml
-    secrets: inherit
-
-  changeset-version:
-    needs:
-      - package
-    if: ${{ needs.package.outputs.hivePublish != 'true' }}
-    uses: ./.github/workflows/changeset-version.yaml
-
-  # Build all packages and applications, and creates Docker images.
-  build:
-    needs:
-      - package
-      - changeset-version
-    uses: ./.github/workflows/build-and-dockerize.yaml
-    with:
-      imageTag:
-        # prettier-ignore
-        ${{ needs.package.outputs.hivePublish == 'true' && needs.package.outputs.hiveVersion || github.sha }}
-      publishSourceMaps: true
-      publishLatest: ${{ needs.package.outputs.hivePublish == 'true' }}
-      targets: build
-      uploadJavaScriptArtifacts: true
-      latestVersion:
-        ${{ needs.package.outputs.hivePublish == 'true' && needs.package.outputs.hiveVersion ||
-        needs.changeset-version.outputs.version }}
-    secrets: inherit
-
-  # Dockerize the CLI in case a CLI version was released
-  publish_docker_cli:
-    needs:
-      - package
-    uses: ./.github/workflows/dockerize-cli.yaml
-    if: ${{ needs.package.outputs.cliPublish == 'true' }}
-    with:
-      cliVersion: ${{ needs.package.outputs.cliVersion }}
-      publishLatest: true
-    secrets: inherit
-
-  # Trigger deployment for staging
-  deploy:
-    name: trigger staging deployment
-    needs:
-      - build
-    runs-on: ubuntu-22.04
-    if: ${{ vars.ENABLE_STAGING_DEPLOYMENT == '1' }}
-    steps:
-      - name: Dispatch Deployment
-        run: |
-          curl --request POST \
-            --url 'https://api.github.com/repos/${{ secrets.PRIVATE_REPO_OWNER }}/${{ secrets.PRIVATE_REPO_NAME }}/dispatches' \
-            --header 'Accept: application/vnd.github+json' \
-            --header 'Authorization: Bearer ${{ secrets.GH_PAT }}' \
-            --header 'X-GitHub-Api-Version: 2022-11-28' \
-            --header 'Content-Type: application/json' \
-            --data '{
-            "event_type": "deploy-staging",
-            "client_payload": {
-              "actor": "${{ github.actor }}",
-              "ref": "${{ github.sha }}",
-              "pulumiRefresh": "true",
-              "hiveAppUsePersistedDocuments": "true"
-            }
-          }'
-
   # ESLint and Prettier
   code-style:
     uses: ./.github/workflows/lint.yaml

.github/workflows/pr.yaml

@@ -83,22 +83,8 @@ jobs:
   typescript:
     uses: ./.github/workflows/typescript-typecheck.yaml
 
-  # Release alpha version on NPM for Hive libraries
+  # Build and test standalone CLI artifacts
   alpha:
     uses: ./.github/workflows/release-alpha.yaml
     if: ${{ github.event.pull_request.title != 'Upcoming Release Changes' }}
     secrets: inherit
-
-  # Release RC version on NPM for Hive libraries
-  release-candidate:
-    uses: the-guild-org/shared-config/.github/workflows/release-snapshot.yml@main
-    if: ${{ github.event.pull_request.title == 'Upcoming Release Changes' }}
-    with:
-      npmTag: rc
-      restoreDeletedChangesets: true
-      buildScript: build:libraries
-      packageManager: pnpm
-      nodeVersion: '24.18'
-    secrets:
-      githubToken: ${{ secrets.GITHUB_TOKEN }}
-      npmToken: ${{ secrets.NPM_TOKEN }}

.github/workflows/release-alpha.yaml

@@ -2,22 +2,6 @@ on:
   workflow_call:
 
 jobs:
-  # Release alpha version on NPM for Hive libraries
-  npm:
-    uses: the-guild-org/shared-config/.github/workflows/release-snapshot.yml@main
-    permissions:
-      pull-requests: write
-      actions: write
-      contents: write
-    with:
-      npmTag: alpha
-      buildScript: build:libraries
-      packageManager: pnpm
-      nodeVersion: '24.18'
-    secrets:
-      githubToken: ${{ secrets.GITHUB_TOKEN }}
-      npmToken: ${{ secrets.NPM_TOKEN }}
-
   # Upload zipped tarballs to GitHub
   cli-artifacts:
     runs-on: ubuntu-22.04
@@ -105,31 +89,3 @@ jobs:
           tar -xzf *.tar.gz
           # Expect the command to succeed
           ./hive/bin/hive --version || exit 1
-
-  extract-cli-version:
-    needs: [npm]
-    runs-on: ubuntu-22.04
-    name: Extract CLI version
-    outputs:
-      published: ${{ steps.cli.outputs.published }}
-      version: ${{ steps.cli.outputs.version }}
-    steps:
-      - name: Extract published version
-        if:
-          needs.npm.outputs.published && contains(needs.npm.outputs.publishedPackages,
-          '"@graphql-hive/cli"')
-        id: cli
-        run: |
-          echo '${{needs.npm.outputs.publishedPackages}}' > cli-ver.json
-          VERSION=`echo $(jq -r '.[] | select(.name | endswith("@graphql-hive/cli")).version' cli-ver.json)`
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "published=true" >> "$GITHUB_OUTPUT"
-
-  publish_docker:
-    needs: [extract-cli-version]
-    uses: ./.github/workflows/dockerize-cli.yaml
-    if: ${{ needs.extract-cli-version.outputs.published == 'true' }}
-    with:
-      cliVersion: ${{ needs.extract-cli-version.outputs.version }}
-      publishLatest: false
-    secrets: inherit