ci(source): ci and cd

.github/workflows/cd.yml

@@ -14,45 +14,49 @@ jobs:
   release:
     name: Publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance    steps:
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
-      # Cache node_modules
-      - uses: actions/setup-node@v3
+      - name: Setup Node.js
+        uses: actions/setup-node@v3
         with:
-          token: ${{secrets.GITHUB_TOKEN}}
-          node-version: 20
+          node-version: 18
           cache: 'npm'
-      - run: npm ci
-      - uses: nrwl/nx-set-shas@v3
 
       - name: Configure CI Git User
         run: |
           git config --global user.name 'guiseek'
           git config --global user.email 'guiseek@gmail.com'
           git remote set-url origin https://guiseek:$GITHUB_TOKEN@github.com/guiseek/nxgs
-
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+
+      - name: Install dependencies
+        run: npm ci
+      - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies
+        run: npm audit signatures
+      - uses: nrwl/nx-set-shas@v3
+      - name: Link package > Print versions > Release
+        run: |
+          npx nx-cloud record -- nx format:check
 
-      - name: Link package
-        run: npx nx run-many -t build --projects devkit,release --skip-nx-cache
+          npx nx run-many -t build --projects devkit,release --skip-nx-cache
           npm link dist/packages/release
           npm ls @nxgs/release
 
-      - name: Print versions
-        run: |
           echo "node: \t $(node -v)"
           echo "npm: \t $(npm -v)"
           echo "$(npx nx --version)"
 
-      - name: Release
-        run: |
-          npx nx-cloud record -- nx format:check
-          npx nx affected --target=release --parallel=3
-
+          npx nx affected --target=release --parallel=false
         env:
-          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GH_TOKEN: ${{secrets.GH_TOKEN}}
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
           NPM_TOKEN: ${{secrets.NPM_TOKEN}}

.github/workflows/ci.yml

@@ -18,6 +18,7 @@ jobs:
     with:
       main-branch-name: main
       number-of-agents: 3
+      node-version: 18
       init-commands: |
         npx nx-cloud start-ci-run --stop-agents-after="build" --agent-count=3
       parallel-commands: |

.github/workflows/gh.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v3
         with:
-          node-version: '20'
+          node-version: 18
 
       - name: Cache dependencies
         uses: actions/cache@v3