chore(ci): update github workflow for recent version of semantic release

this updates the release workflow to support npm trusted publishing and
recent versions of semantic release

Author: esatterwhite

.github/workflows/release.yml

@@ -3,41 +3,65 @@ name: Test + Release
 on:
   pull_request:
     branches:
-      - main
+      - master
 
   push:
     branch:
-      - main
+      - master
 jobs:
   test:
     name: Test Suite
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20.x, 22.x, 24.x]
 
     steps:
       - name: Checkout
         uses: actions/checkout@v2
-
-      - name: Install
+      - name: node ${{ matrix.node-version }}
+        uses: actions/setup-node@v1
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: install
         run: npm install
+      - name: test
+        run: npm test
 
   release:
-    name: release
+    name: Release
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: test
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      issues: write
+      pull-requests: write
     steps:
+      - name: Generate Token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
       - name: Checkout
-        uses: actions/checkout@v2
-      - uses: actions/setup-node@v1
+        uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: false
+
+      - uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: 24
       - run: npm install
 
       - name: Publish
         run: npm run release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           GIT_AUTHOR_NAME: 'Dependant Bot'
           GIT_AUTHOR_EMAIL: 'release-bot@codedependant.net'
           GIT_COMMITTER_NAME: 'Dependant Bot'
           GIT_COMMITTER_EMAIL: 'release-bot@codedependant.net'
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TOKEN: 'false'

.npmrc

@@ -1,3 +1 @@
-hoist=true
 package-lock=false
-lock-file=false

package.json

@@ -21,8 +21,8 @@
     "lint:fix": "npm run lint -- --fix",
     "local": "env $(cat env/local.env)",
     "pretap": "npm run lint",
-    "release": "semantic-release",
-    "release:dry": "semantic-release --no-ci --dry-run --branches=${BRANCH_NAME:-main}"
+    "release": "npx semantic-release",
+    "release:dry": "npm run release -- --no-ci --dry-run --branches=${BRANCH_NAME:-main}"
   },
   "keywords": [
     "semantic-release"
@@ -66,13 +66,10 @@
     ]
   },
   "devDependencies": {
-    "@codedependant/release-config-npm": "^1.0.4",
-    "@semantic-release/changelog": "^5.0.1",
-    "@semantic-release/git": "^9.0.0",
-    "@semantic-release/github": "^7.0.7",
+    "@codedependant/release-config-core": "^1.1.1",
+    "@semantic-release/changelog": "^6.0.3",
     "eslint": "^8.5.0",
     "eslint-config-codedependant": "^3.0.0",
-    "semantic-release": "17",
     "sinon": "^9.0.2",
     "stream-buffers": "^3.0.3",
     "tap": "^16.0.0"

release.config.js

@@ -3,7 +3,8 @@
 /* istanbul ignore file */
 module.exports = {
   branches: ['main']
-, extends: '@codedependant/release-config-npm'
+, npmPublish: true
+, extends: '@codedependant/release-config-core'
 , changelogFile: 'CHANGELOG.md'
 , changelogTitle: '# Semantic Release Docker'
 }