The only breaking change in v5.0.0 is the move to the node 24 runtime; inputs,
outputs and the manifest/config format are unchanged. Kept as its own commit
since this action drives the release flow and is the one worth reverting alone
if anything misbehaves.
checkout v4.3.1 -> v7.0.1, setup-node v4.4.0 -> v7.0.0, stale v9.1.0 -> v10.4.0.
The breaking changes across those majors do not apply here:
- checkout v5/v6 harden `pull_request_target` checkouts; no workflow uses it
- setup-node v5 auto-caches when package.json has a `packageManager` field;
it has none, and `cache: npm` is set explicitly anyway
- setup-node v7 drops the dummy NODE_AUTH_TOKEN export; the publish job sets
NODE_AUTH_TOKEN itself
- stale v10 only moves the runtime to node 24
All of them also raise the runtime to node 24, which clears the deprecation
warnings on recent runs.
Also drops the explicit `npm install -g npm@latest` step: node 24 bundles
npm 11.16, well over the >= 11.5.1 that trusted publishing requires. Pulling
an unpinned npm@latest right before publishing 258 packages was the larger
risk of the two.
npm validates the OIDC claim of the entry-point workflow, not the one that
runs `npm publish`. Calling publish.yml via workflow_call meant the trust
check could never match, so the publish job moves inline into
release-please.yml and publish.yml is removed.
setup-node with Node 22 ships npm 10.x; trusted publishing needs >= 11.5.1,
hence the explicit npm upgrade before publishing.
NPM_TOKEN stays as a fallback for packages that have no trusted publisher
yet — a brand new plugin cannot get one until it exists on npm. OIDC takes
precedence wherever a config is present.
Adds scripts/tasks/trust-packages.sh to configure the trusted publisher for
all 258 packages; npm has no multi-package call and `npm trust` requires
interactive 2FA, so it runs locally, in parallel, and is resumable.
The publish workflow requires id-token: write for npm provenance.
When called via workflow_call, permissions are inherited from the
caller, so id-token must be declared in release-please.yml.
Split publish into a separate reusable workflow (publish.yml) that can
be triggered manually via workflow_dispatch or called from release-
please. This allows re-running publish independently when a release
already exists but publishing failed.
Add --provenance flag to npm publish for supply chain security.
Add id-token: write permission to release workflow for OIDC-based
provenance attestation. Fix MIN_CORE_VERSION to dynamically use
current version instead of hardcoded ^8.0.2.
Update CI workflow: restrict triggers to master+PRs, add concurrency
groups and npm cache. Update release-please and stale workflows to
latest action versions. Replace single ISSUE_TEMPLATE.md with YAML-
based templates (bug report, feature request, config). Rewrite
CONTRIBUTING.md for awesome-cordova-plugins.
Daniel Sogl
