Feat: trusted publisher publishing

.github/workflows/publish_validator.yml

@@ -5,6 +5,12 @@ on:
       branches:
         - master
 
+# Npm authentication via OpenID Connect (OIDC)
+# https://docs.npmjs.com/trusted-publishers
+permissions:
+    id-token: write  # Required for OIDC
+    contents: read
+
 jobs:
     check-versions:
         name: check-version-job
@@ -58,24 +64,18 @@ jobs:
                 fetch-depth: 0
 
             - name: Setup Node.js
-              uses: actions/setup-node@v2
+              uses: actions/setup-node@v4
               with:
-                node-version: '18'
+                node-version: '20'
                 registry-url: 'https://registry.npmjs.org'
 
             - name: Install dependencies
               run: yarn
 
-            - name: Load secrets from 1Password
-              uses: 1password/load-secrets-action@v2.0.0
-              with:
-                export-env: true # Export loaded secrets as environment variables
-              env:
-                OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
-                NODE_AUTH_TOKEN: "op://rbiv7rvkkrsdlpcrz3bmv7nmcu/ppzc4jxrwkf3omdmcs7z2wiwum/credential"
-
+            # Ensure npm 11.5.1 or later is installed for OIDC support
+            - name: Update npm
+              run: npm install -g npm@11.6.2
+
             - name: Publish to npm
               run: npm publish
-              env:
-                NODE_AUTH_TOKEN: ${{ env.NODE_AUTH_TOKEN }}
 

gbfs-validator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gbfs-validator",
-  "version": "1.0.14",
+  "version": "1.0.16",
   "author": "MobilityData",
   "main": "index.js",
   "license": "MIT",