TrigenSoftware / simple-release / 33974348767

70%

push

github

ci: publish through npm trusted publishing (#199)

The release job authenticates with the npm registry through GitHub's OIDC token instead of the `NPM_TOKEN` secret: `id-token: write` on the job, no `registry-url` in `actions/setup-node`, no `NODE_AUTH_TOKEN`, and Node.js 24 for the npm CLI 11.5.1+ that trusted publishing needs. The explicit `permissions` block also keeps `contents: write` and `pull-requests: write`, which the pull request and release flows of the job use. Provenance attestations come with it. Requires the trusted publisher to be registered for every published package on npmjs.com: repository `TrigenSoftware/simple-release`, workflow `release.yml`.

152 of 211 branches covered (72.04%)

Branch coverage included in aggregate %.

725 of 1046 relevant lines covered (69.31%)

11.05 hits per line