From 0ebee77df2bfb63479c4bb42b4da4df8a98bcc89 Mon Sep 17 00:00:00 2001 From: DiTo97 Date: Tue, 21 Apr 2026 10:41:40 +0200 Subject: [PATCH] Use the production environment token for releases Run npm publishes in the production environment so the release job reads its token from the environment secret, and bump setup-node to v5 to clear the Node 20 action deprecation warning. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/copilot-setup-steps.yml | 2 +- .github/workflows/release.yml | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index a8cf86e..663fdf0 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -24,7 +24,7 @@ jobs: uses: actions/checkout@v5 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: '24' cache: npm diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5db600b..723ecf0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -8,6 +8,7 @@ on: jobs: release: runs-on: ubuntu-latest + environment: production permissions: contents: read id-token: write @@ -17,7 +18,7 @@ jobs: uses: actions/checkout@v5 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: '24' cache: npm