publishing v 3.7.1

.github/workflows/nodejs.yml

@@ -1,13 +1,14 @@
 name: CI
 
+# Pushes to main are covered by the release workflow, which runs the same checks
 on:
-  push:
-    branches:
-      - main
   pull_request:
     branches:
       - '**'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test on Node.js ${{ matrix.node }}
@@ -17,14 +18,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: [12, 14]
+        node: [22, 24]
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node }}
+          cache: npm
 
       - run: npm ci
 

.github/workflows/publish.yml

@@ -1,43 +1,44 @@
 name: Release and Publish
 
 on:
-  pull_request:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-      - name: Setup Node.js
-        uses: actions/setup-node@v2
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
-          node-version: 14.x
-      - name: npm install
-        run: |
-          npm install
-      - name: npm test
-        run: |
-          npm test
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm test
+
   release:
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     needs: [test]
+    permissions:
+      contents: write
+      # Lets npm attach build provenance to the published package
+      id-token: write
     steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-      - name: Setup Node.js
-        uses: actions/setup-node@v2
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@v5
         with:
-          node-version: 14.x
-      - name: npm install
-        run: |
-          npm install
-      - name: npx semantic-release
-        run: |
-          npx semantic-release
+          node-version: 22
+          cache: npm
+          registry-url: https://registry.npmjs.org
+      - run: npm ci
+      - run: npx semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true

.gitignore

@@ -136,4 +136,5 @@ yarn-error.log*
 .env.production.local
 
 # vercel
-.vercel
+.vercel
+.claude/

.husky/pre-commit

@@ -0,0 +1 @@
+npx lint-staged