ci: prepare for trusted publishing (#6032)

lachlancollins · web-flow · commit 496c9320a267 · 2025-12-07T02:02:49.000+11:00
diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
@@ -19,11 +19,11 @@ jobs:
     if: ${{ github.event_name == 'push' || !github.event.pull_request.draft }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v6.0.1
       - name: Setup Tools
         uses: tanstack/config/.github/setup@main
       - name: Fix formatting
-        run: pnpm prettier:write
+        run: pnpm format
       - name: Generate labeler config
         run: pnpm labeler-generate
       - name: Apply fixes
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
@@ -1,8 +1,12 @@
-name: Pull Request Labeler
+name: Labeler
 
 on:
   - pull_request_target
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   labeler:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
@@ -1,4 +1,4 @@
-name: pr
+name: PR
 
 on:
   pull_request:
@@ -13,6 +13,7 @@ env:
 
 permissions:
   contents: read
+  pull-requests: write
 
 jobs:
   test:
@@ -22,15 +23,15 @@ jobs:
       TSR_TMP_DIR: ./tmp
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0
       - name: Start Nx Agents
         run: npx nx-cloud start-ci-run --distribute-on=".nx/workflows/dynamic-changesets.yaml"
       - name: Setup Tools
         uses: tanstack/config/.github/setup@main
       - name: Get base and head commits for `nx affected`
-        uses: nrwl/nx-set-shas@v4.1.2
+        uses: nrwl/nx-set-shas@v4.4.0
         with:
           main-branch-name: main
       - name: Run Checks
@@ -43,7 +44,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0
       - name: Setup Tools
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -1,4 +1,4 @@
-name: ci
+name: Release
 
 on:
   workflow_dispatch:
@@ -20,15 +20,16 @@ env:
 permissions:
   contents: write
   id-token: write
+  pull-requests: write
 
 jobs:
   test:
-    name: Build & Test
+    name: Release
     if: github.repository_owner == 'TanStack'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0
       - name: Start Nx Agents
@@ -44,9 +45,7 @@ jobs:
         run: |
           git config --global user.name 'Tanner Linsley'
           git config --global user.email 'tannerlinsley@users.noreply.github.com'
-          npm config set '//registry.npmjs.org/:_authToken' "${NPM_TOKEN}"
           pnpm run cipublish
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           TAG: ${{ inputs.tag }}
diff --git a/AGENTS.md b/AGENTS.md
@@ -48,7 +48,7 @@ TanStack Router is a type-safe router with built-in caching and URL state manage
 - **Critical**: Always run unit and type tests during development - do not proceed if they fail
 - **Test types:** `pnpm test:unit`, `pnpm test:types`, `pnpm test:eslint`, `pnpm test:e2e`, `pnpm test:build`
 - **Full CI suite:** `pnpm test:ci`
-- **Fix formatting:** `pnpm prettier:write`
+- **Fix formatting:** `pnpm format`
 - **Efficient targeted testing workflow:**
   1. **Affected only:** `npx nx affected --target=test:unit` (compares to main branch)
   2. **Specific packages:** `npx nx run @tanstack/react-router:test:unit`
diff --git a/package.json b/package.json
@@ -15,7 +15,6 @@
     "test:pr": "nx affected --targets=test:eslint,test:unit,test:e2e,test:types,test:build,build",
     "test:ci": "nx run-many --targets=test:eslint,test:unit,test:e2e,test:types,test:build,build",
     "test:eslint": "nx affected --target=test:eslint --exclude=examples/**,e2e/**",
-    "test:format": "pnpm run prettier --check",
     "test:unit": "nx affected --target=test:unit --exclude=examples/**,e2e/**",
     "test:unit:dev": "pnpm run test:unit && nx watch --all -- pnpm run test:unit",
     "test:build": "nx affected --target=test:build --exclude=examples/**",
@@ -25,12 +24,11 @@
     "build:all": "nx run-many --target=build --exclude=examples/** --exclude=e2e/**",
     "watch": "pnpm run build:all && nx watch --all -- pnpm run build:all",
     "dev": "pnpm run watch",
-    "prettier": "prettier --experimental-cli --ignore-unknown '**/*'",
-    "prettier:write": "pnpm run prettier --write",
+    "format": "prettier --experimental-cli --ignore-unknown '**/*' --write",
     "cipublish": "node scripts/publish.js",
     "gpt-generate": "node gpt/generate.js",
     "set-ts-version": "node scripts/set-ts-version.js",
-    "labeler-generate": "node scripts/generate-labeler-config.mjs",
+    "labeler-generate": "node scripts/generate-labeler-config.ts",
     "cleanup-empty-packages": "node scripts/cleanup-empty-packages.mjs",
     "test:docs": "node scripts/verify-links.ts"
   },
diff --git a/scripts/generate-labeler-config.ts b/scripts/generate-labeler-config.ts
@@ -2,19 +2,13 @@ import * as fs from 'node:fs'
 import * as path from 'node:path'
 import * as prettier from 'prettier'
 
-/**
- * Pairs of package labels and their corresponding paths
- * @typedef {[string, string]} LabelerPair
- */
-
-/**
- * @returns {Array<LabelerPair>} Pairs of package labels and their corresponding paths
- */
-function readPairsFromFs() {
+/** Pairs of package labels and their corresponding paths */
+type LabelerPair = [string, string]
+
+function readPairsFromFs(): Array<LabelerPair> {
   const ignored = new Set(['.DS_Store'])
 
-  /** @type {Array<LabelerPair>} */
-  const pairs = []
+  const pairs: Array<LabelerPair> = []
 
   // Add subfolders in the packages folder, i.e. packages/**
   fs.readdirSync(path.resolve('packages'))
@@ -40,11 +34,7 @@ function readPairsFromFs() {
   return pairs
 }
 
-/**
- * @param {Array<LabelerPair>} pairs
- * @returns {Promise<string>} YAML string for the labeler config
- */
-async function generateLabelerYaml(pairs) {
+async function generateLabelerYaml(pairs: Array<LabelerPair>): Promise<string> {
   function s(n = 1) {
     return ' '.repeat(n)
   }
@@ -96,7 +86,7 @@ async function run() {
   // Convert the pairs into valid yaml
   const yamlStr = await generateLabelerYaml(pairs)
 
-  // Write to '.github/labeler.yml'
+  // Write to 'labeler-config.yml'
   const configPath = path.resolve('labeler-config.yml')
   fs.writeFileSync(configPath, yamlStr, {
     encoding: 'utf-8',
diff --git a/tsconfig.json b/tsconfig.json
@@ -11,7 +11,7 @@
     "forceConsistentCasingInFileNames": true,
     "isolatedModules": true,
     "lib": ["DOM", "DOM.Iterable", "ES2022"],
-    "module": "ES2022",
+    "module": "ESNext",
     "moduleResolution": "Bundler",
     "noEmit": true,
     "noImplicitReturns": true,
@@ -24,5 +24,5 @@
     "stripInternal": true,
     "target": "ES2020"
   },
-  "include": ["eslint.config.js", "prettier.config.js", "scripts"]
+  "include": ["*.config.*", "scripts"]
 }
