Trusted publishing, update CI

.github/workflows/ci.yml

@@ -22,12 +22,14 @@ jobs:
         node-version: [20.x]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+      - name: Enable Corepack
+        run: corepack enable
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-          cache: 'npm'
+          cache: 'yarn'
 
       - uses: browser-actions/setup-chrome@v1
         id: setup-chrome
@@ -36,17 +38,6 @@ jobs:
       - run: |
           ${{ steps.setup-chrome.outputs.chrome-path }} --version
 
-        # Install yarn dependencies.
-      - name: Get yarn cache directory path
-        id: yarn-cache-dir-path
-        run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
-      - uses: actions/cache@v4
-        id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
-        with:
-          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-yarn-
       - run: yarn install
       - name: Test with checked-in WASM files
         run: yarn test

.github/workflows/release.yml

@@ -2,34 +2,52 @@ name: Release
 
 on:
   push:
-    branches:
-      - master
+    branches: [master]
+  workflow_dispatch: # For dev publishing
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  id-token: write # Required for OIDC / trusted publishing
+  contents: write # Required for changesets pushing commits
+  pull-requests: write # Required for changesets creating PRs
+
 jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
-
-      - name: Setup Node.js 16
-        uses: actions/setup-node@v3
+        uses: actions/checkout@v5
+      - name: Enable Corepack
+        run: corepack enable
+      - name: Setup Node.js 20
+        uses: actions/setup-node@v6
         with:
           node-version: 20
+          cache: yarn
+      - name: Update npm
+        run: |
+          npm install -g npm@latest
+          npm --version
 
       - name: Install Dependencies
-        run: yarn
+        run: yarn install --frozen-lockfile
 
       - name: Create Release Pull Request or Publish to npm
         id: changesets
         uses: changesets/action@v1
+        if: ${{ github.event_name == 'push' }}
         with:
           # This expects you to have a script called release which does a build for your packages and calls changeset publish
           publish: yarn release
           version: yarn changeset version
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Dev publish
+        if: ${{ github.event_name == 'workflow_dispatch' }}
+        run: |
+          yarn changeset version --no-git-tag --snapshot dev
+          yarn changeset publish --tag dev
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}