eresearchqut / ddb-repository / 26067908267

98%

push

github

fix: decouple npm publishing from semantic-release to use OIDC

semantic-release/npm validates NPM_TOKEN against the target registry
during verifyConditions, which breaks when using OIDC trust (no static
token). Instead:
- Configure @semantic-release/npm with npmPublish: false so it only
  bumps package.json version without attempting to publish
- Capture pre/post version to detect whether a release was made
- Publish to npmjs.com with --provenance (uses OIDC trust, id-token:write)
- Publish to GitHub Packages with GITHUB_TOKEN, conditionally on release

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

187 of 220 branches covered (85.0%)

Branch coverage included in aggregate %.

296 of 305 relevant lines covered (97.05%)

159.3 hits per line