Npm trusted publishing

.github/workflows/codeql-analysis.yml

@@ -23,14 +23,14 @@ jobs:
 
     steps:
     - name: Checkout code from the repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
 
     # Perform CodeQL Analysis
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4

.github/workflows/generate-clients.yml

@@ -22,8 +22,9 @@ name: Generate OpenAPI Clients
 on:
   push:
     branches: [ main ]
-  # pull_request:
-  #   branches: [ the-pr-name ]
+
+permissions:
+  contents: write
 
 jobs:
   generate-eMASS-clients:
@@ -33,7 +34,7 @@ jobs:
 
       # Checkout your code
       - name: Checkout 🛎️
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 2  # Fetch the last two commits to compare changes.
 

.github/workflows/generate_docs.yml

@@ -17,13 +17,17 @@ on:
     branches: [ main ]
   pull_request:
     branches: [ main ]
+
+permissions:
+  contents: write
+
 jobs:
   test_job:
     runs-on: ubuntu-latest
     name: Generate Document with redoc
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       # Use redoc-cli-github-action to generate the HTML bundle
       - name: Generate the HTML bundle (redoc-cli)
@@ -38,7 +42,7 @@ jobs:
 
       # Deploy static files to GitHub Pages
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./docs/redoc

.github/workflows/gh-pages.yml

@@ -14,14 +14,17 @@ on:
     branches: [ main ]
   pull_request:
     branches: [ main ]
+
+permissions:
+  contents: write
 
 jobs:
   build-deploy:
     runs-on: ubuntu-latest
     name: Copy Markdown Files to gh_pages
     steps:
       - name: Checkout 🛎️
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Build Deployment Folder 🔧
         run: |
@@ -39,7 +42,7 @@ jobs:
           sudo cp ./docs/eMASS_API_Documentation.pdf /publish/docs/eMASS_API_Documentation.pdf
 
       - name: Deploy Markdown Files 🚀
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: /publish

.github/workflows/publish-gem.yml

@@ -1,16 +1,20 @@
 name: Build and Release gem
+
 on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release to gem hosts
     runs-on: ubuntu-latest
     steps:
       - name: Setup ruby
         uses: actions/setup-ruby@v1
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - run: git fetch origin +refs/tags/*:refs/tags/*

.github/workflows/publish-npm-gpr.yml

@@ -1,19 +1,24 @@
 name: Build and Release NPM to GPR
+
 on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build-deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v5
         with:
-          node-version: "18.x"
-          registry-url: https://npm.pkg.github.com/
+          node-version: "22"
+          registry-url: 'https://npm.pkg.github.com/'
           scope: '@mitre'
 
       - name: Build the NPM Package
@@ -27,12 +32,6 @@ jobs:
           cd src/typescript_client
           npm pack
 
-      # Setup .npmrc file to publish to GitHub Package Registry
-      - uses: actions/setup-node@v3
-        with:
-          registry-url: 'https://npm.pkg.github.com'
-          scope: '@mitre'
-
       # Publish emass_client to GitHub Package Registry
       - name: Publish emass_client to GPR
         run: |

.github/workflows/publish-npm-registry.yml

@@ -1,20 +1,28 @@
 name: Build and Release to NPM
+
 on:
   release:
     types: [published]
 
+permissions:
+  id-token: write # required for trusted publishing's use of OIDC
+  contents: read
+
 jobs:
   build-deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5
 
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v5
         with:
-          node-version: "18.x"
+          node-version: "22"
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Manually update npm to 11.5.1 or later which is the required version for trusted publishing to work # this step can be removed after the ubuntu runner has the correct minimum version of npm installed
+        run: npm install -g npm@latest
+
       - name: Build the NPM Package
         run: |
           cd src/typescript_client
@@ -32,5 +40,3 @@ jobs:
         run: |
           cd src/typescript_client
           npm publish --access public mitre-emass_client-*.tgz
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/publish-to-pypi.yml

@@ -5,15 +5,18 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   build-n-publish:
     name: Build and publish Python 🐍 distributions 📦 to PyPI
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: "3.x"
 

.github/workflows/publish-to-test-pypi.yml

@@ -25,7 +25,9 @@ on:
     workflows: [Generate OpenAPI Clients]
     types:
       - completed
-# on: push
+
+permissions:
+  contents: read
 
 jobs:
   build-n-publish:
@@ -35,7 +37,7 @@ jobs:
     steps:
       # Checkout your code
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       # Check if src/python_client/README.md has changed using git diff
       - name: Check for changes in src/python_client/README.md
@@ -50,7 +52,7 @@ jobs:
       # Set up Python only if the file has changed
       - name: Set up Python
         if: steps.check-changes.outputs.modified == 'true'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.x"
 

.github/workflows/test-ruby-client.yml

@@ -9,38 +9,41 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:
       fail-fast: false
       matrix:
        platform: [ ubuntu-latest, macos-latest ]
        # platform: [ ubuntu-latest, macos-latest, windows-latest ]
-       ruby-version: ['2.7', '3.4']
+       ruby-version: ['3.4']
     runs-on: ${{ matrix.platform }}
     steps:
       - name: Setup Ruby ${{ matrix.ruby-version }}
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ matrix.ruby-version }}
-      - uses: actions/checkout@v4
-      - uses: crazy-max/ghaction-chocolatey@v1
-        with:
-          args: install curl -y
-        if: matrix.platform == 'windows-latest'
-      - name: Testing on ${{ matrix.platform }} for Ruby ${{ matrix.ruby-version }}
-        if: matrix.platform == 'windows-latest'
-        env: 
-          CI_LIB_PATH: D:\a\emass_client\emass_client/src/ruby_client/lib
-          CI_SPEC_PATH: D:\a\emass_client\emass_client/src/ruby_client/spec        
-        run: |
-          # Add-Content $env:GITHUB_PATH "C:\ProgramData\chocolatey\lib\curl\tools"
-          # set PATH=C:\ProgramData\chocolatey\lib\curl\tools;%PATH%
-          echo "C:\ProgramData\chocolatey\lib\curl\tools" >> $GITHUB_PATH
-          cd src/ruby_client
-          bundle install
-          bundle info emass_client
-          rspec -I "${{ env.CI_LIB_PATH }}" -I "${{ env.CI_SPEC_PATH }}" "${{ env.CI_SPEC_PATH }}" --format progress
+      - uses: actions/checkout@v5
+      # - uses: crazy-max/ghaction-chocolatey@v1
+      #   with:
+      #     args: install curl -y
+      #   if: matrix.platform == 'windows-latest'
+      # - name: Testing on ${{ matrix.platform }} for Ruby ${{ matrix.ruby-version }}
+      #   if: matrix.platform == 'windows-latest'
+      #   env: 
+      #     CI_LIB_PATH: D:\a\emass_client\emass_client/src/ruby_client/lib
+      #     CI_SPEC_PATH: D:\a\emass_client\emass_client/src/ruby_client/spec        
+      #   run: |
+      #     # Add-Content $env:GITHUB_PATH "C:\ProgramData\chocolatey\lib\curl\tools"
+      #     # set PATH=C:\ProgramData\chocolatey\lib\curl\tools;%PATH%
+      #     echo "C:\ProgramData\chocolatey\lib\curl\tools" >> $GITHUB_PATH
+      #     cd src/ruby_client
+      #     bundle install
+      #     bundle info emass_client
+      #     rspec -I "${{ env.CI_LIB_PATH }}" -I "${{ env.CI_SPEC_PATH }}" "${{ env.CI_SPEC_PATH }}" --format progress
       - name: Testing on ${{ matrix.platform }} for Ruby ${{ matrix.ruby-version }}
         if: matrix.platform == 'ubuntu-latest'
         env: 
@@ -61,4 +64,4 @@ jobs:
           bundle install
           bundle info emass_client
           rspec -I "${{ env.CI_LIB_PATH }}" -I "${{ env.CI_SPEC_PATH }}" "${{ env.CI_SPEC_PATH }}" --format progress
-
+