feat: prompt trusted publisher

.github/workflows/release.yml

@@ -1,9 +1,5 @@
 name: Release
 
-permissions:
-  id-token: write
-  contents: write
-
 on:
   push:
     tags:
@@ -11,25 +7,9 @@ on:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    uses: sxzz/workflows/.github/workflows/release.yml@v1
-    steps:
-      - uses: actions/checkout@v4
     with:
-          fetch-depth: 0
+      publish: true
-      - uses: pnpm/action-setup@v4
+    permissions:
-      - uses: actions/setup-node@v4
+      contents: write
-        with:
+      id-token: write
-          node-version: lts/*
-          registry-url: https://registry.npmjs.org/
-
-      - run: pnpm dlx changelogithub
-        env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-
-      # # Uncomment the following lines to publish to npm on CI
-      #
-      # - run: pnpm install
-      # - run: pnpm publish --no-git-checks -r --access public
-      #   env:
-      #     NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-      #     NPM_CONFIG_PROVENANCE: true

README.md

@@ -8,6 +8,14 @@
 
 _description_
 
+## Note for Developers
+
+This starter recommands using [npm Trusted Publisher](https://github.com/e18e/ecosystem-issues/issues/201), where the release is done on CI to ensure the security of the packages.
+
+To do so, you need to run `pnpm publish` manually for the very first time to create the package on npm, and then go to `https://www.npmjs.com/package/<your-package-name>/access` to set the connection to your GitHub repo.
+
+Then for the future releases, you can run `pnpm run release` to do the release and the GitHub Actions will take care of the release process.
+
 ## Sponsors
 
 <p align="center">

package.json

@@ -30,7 +30,7 @@
     "dev": "unbuild --stub",
     "lint": "eslint",
     "prepublishOnly": "nr build",
-    "release": "bumpp && pnpm publish",
+    "release": "bumpp",
     "start": "tsx src/index.ts",
     "test": "vitest",
     "typecheck": "tsc --noEmit",