ci: npm should use OIDC

.github/workflows/lint.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: 22.x
 
       - name: Install dependencies
         run: |

.github/workflows/release.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [authorize]
     permissions:
-      id-token: write # Required for OIDC
+      id-token: write # Required for OIDC (AWS + npm Trusted Publishing)
       contents: write
     env:
       GIT_AUTHOR_NAME: amplitude-sdk-bot
@@ -61,7 +61,7 @@ jobs:
           fetch-depth: 0
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@v2
         with:
           role-to-assume: arn:aws:iam::358203115967:role/github-actions-role
           aws-region: us-west-2
@@ -81,7 +81,7 @@ jobs:
         run: pip install boto3==1.14.63
 
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
 
@@ -91,6 +91,7 @@ jobs:
       - name: Run tests
         run: make test
 
+      # npm auth via OIDC (Trusted Publishing); no NPM_TOKEN needed when package has Trusted Publisher on npmjs.com
       - name: Release --dry-run # Uses release.config.js
         if: ${{ github.event.inputs.releaseType == 'dry-run' }}
         env:

package.json

@@ -39,6 +39,7 @@
     "@semantic-release/changelog": "^6.0.2",
     "@semantic-release/exec": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
+    "@semantic-release/npm": "^13.0.0",
     "chai": "^4.3.7",
     "chokidar-cli": "^3.0.0",
     "date-fns": "^2.29.3",

release.config.js

@@ -1,5 +1,5 @@
 module.exports = {
-  "branches": ["main"],
+  "branches": ["main", "v8.x"],
   "plugins": [
     ["@semantic-release/commit-analyzer", {
       "preset": "angular",