From 40c11e458223ef2b6d754567f19e69865e2cac94 Mon Sep 17 00:00:00 2001
From: Yohay Nahmany <yohay.arch@gmail.com>
Date: Tue, 20 Oct 2026 12:59:27 +0200
Subject: [PATCH] ci: use the shared oss-workflows for CI and publish; release
 1.2.2 [PRV-8217]

ci.yml and publish.yml become thin callers of PruvoNet/oss-workflows
(pinned by SHA, v1). The caller keeps the name publish.yml, which the
npm trusted publisher names. 1.2.2 proves OIDC publishing through a
reusable workflow before the other packages move. No code change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml      | 46 ++++++++-------------------------
 .github/workflows/publish.yml | 48 ++++-------------------------------
 package-lock.json             |  4 +--
 package.json                  |  2 +-
 4 files changed, 18 insertions(+), 82 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 06786d3..949387e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,45 +9,19 @@ on:
       - '**'
   workflow_call:
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
-  test:
-    name: CI
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [18.x, 20.x, 22.x, 24.x]
-
-    steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
-        name: Checkout
-        with:
-          persist-credentials: false
-
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests
-        run: npm test
+  ci:
+    uses: PruvoNet/oss-workflows/.github/workflows/ci-node.yml@638c70a621e280086c02bc7dcf4ccca4580d9041 # v1
+    permissions:
+      contents: read
+    with:
+      package-manager: npm
+      node-versions: '["18.x", "20.x", "22.x", "24.x"]'
+      test-command: npm test
 
   zizmor:
-    name: Workflow security (zizmor)
-    runs-on: ubuntu-latest
+    uses: PruvoNet/oss-workflows/.github/workflows/zizmor.yml@638c70a621e280086c02bc7dcf4ccca4580d9041 # v1
     permissions:
       contents: read
-    steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
-        with:
-          persist-credentials: false
-
-      - uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
-        with:
-          advanced-security: false
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3c912e2..c7433dd 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,5 +1,6 @@
 name: Publish
 
+# The npm trusted publisher names this file (publish.yml), so keep its name.
 on:
   release:
     types: [ published ]
@@ -7,11 +8,6 @@ on:
 
 permissions: {}
 
-env:
-  # Trusted publishing needs npm >= 11.5.1, which ships with Node 24.
-  NODE_VERSION: 24.x
-  REGISTRY: https://registry.npmjs.org/
-
 jobs:
   test:
     name: Run tests before publish
@@ -19,45 +15,11 @@ jobs:
     permissions:
       contents: read
 
-  publish_version:
-    name: Publish
-    runs-on: ubuntu-latest
+  publish:
     needs: [ test ]
-    # A pre-release must never become the stable `latest` version on npm.
-    if: github.event_name != 'release' || !github.event.release.prerelease
+    uses: PruvoNet/oss-workflows/.github/workflows/publish-npm.yml@638c70a621e280086c02bc7dcf4ccca4580d9041 # v1
     permissions:
       id-token: write # OIDC token for npm trusted publishing
       contents: read
-    steps:
-
-      - name: Checkout
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
-        with:
-          persist-credentials: false
-
-      - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          registry-url: ${{ env.REGISTRY }}
-          # No cache in the job that publishes: a poisoned cache entry would ship in the package.
-          package-manager-cache: false
-
-      - name: Install dependencies
-        run: npm ci
-
-      # npm never lets a published version be reused, so a tag/manifest mismatch must fail before publishing.
-      - name: Check the release tag matches package.json
-        if: github.event_name == 'release'
-        env:
-          TAG: ${{ github.event.release.tag_name }}
-        run: |
-          VERSION=$(node -p "require('./package.json').version")
-          if [ "${TAG#v}" != "$VERSION" ]; then
-            echo "::error::Release tag $TAG does not match package.json version $VERSION"
-            exit 1
-          fi
-
-      - name: Publish
-        run: |
-          npm publish
+    with:
+      package-manager: npm
diff --git a/package-lock.json b/package-lock.json
index 471850b..f8dfee7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "loopback-component-flatstorage",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "loopback-component-flatstorage",
-      "version": "1.2.1",
+      "version": "1.2.2",
       "license": "AGPL-3.0",
       "dependencies": {
         "formidable": "^1.1.1",
diff --git a/package.json b/package.json
index 8a498c0..8f84669 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "loopback-component-flatstorage",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "loopback component for attaching to various cloud storage providers with ACL functionality",
   "main": "index.js",
   "files": [