ci: use the shared oss-workflows for CI and publish; release 1.2.2 [PRV-8217]

.github/workflows/ci.yml

@@ -9,45 +9,19 @@ on:
       - '**'
   workflow_call:
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
-  test:
-    name: CI
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [18.x, 20.x, 22.x, 24.x]
-
-    steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
-        name: Checkout
-        with:
-          persist-credentials: false
-
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests
-        run: npm test
+  ci:
+    uses: PruvoNet/oss-workflows/.github/workflows/ci-node.yml@638c70a621e280086c02bc7dcf4ccca4580d9041 # v1
+    permissions:
+      contents: read
+    with:
+      package-manager: npm
+      node-versions: '["18.x", "20.x", "22.x", "24.x"]'
+      test-command: npm test
 
   zizmor:
-    name: Workflow security (zizmor)
-    runs-on: ubuntu-latest
+    uses: PruvoNet/oss-workflows/.github/workflows/zizmor.yml@638c70a621e280086c02bc7dcf4ccca4580d9041 # v1
     permissions:
       contents: read
-    steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
-        with:
-          persist-credentials: false
-
-      - uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
-        with:
-          advanced-security: false

.github/workflows/publish.yml

@@ -1,63 +1,25 @@
 name: Publish
 
+# The npm trusted publisher names this file (publish.yml), so keep its name.
 on:
   release:
     types: [ published ]
   workflow_dispatch:
 
 permissions: {}
 
-env:
-  # Trusted publishing needs npm >= 11.5.1, which ships with Node 24.
-  NODE_VERSION: 24.x
-  REGISTRY: https://registry.npmjs.org/
-
 jobs:
   test:
     name: Run tests before publish
     uses: ./.github/workflows/ci.yml
     permissions:
       contents: read
 
-  publish_version:
-    name: Publish
-    runs-on: ubuntu-latest
+  publish:
     needs: [ test ]
-    # A pre-release must never become the stable `latest` version on npm.
-    if: github.event_name != 'release' || !github.event.release.prerelease
+    uses: PruvoNet/oss-workflows/.github/workflows/publish-npm.yml@638c70a621e280086c02bc7dcf4ccca4580d9041 # v1
     permissions:
       id-token: write # OIDC token for npm trusted publishing
       contents: read
-    steps:
-
-      - name: Checkout
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
-        with:
-          persist-credentials: false
-
-      - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          registry-url: ${{ env.REGISTRY }}
-          # No cache in the job that publishes: a poisoned cache entry would ship in the package.
-          package-manager-cache: false
-
-      - name: Install dependencies
-        run: npm ci
-
-      # npm never lets a published version be reused, so a tag/manifest mismatch must fail before publishing.
-      - name: Check the release tag matches package.json
-        if: github.event_name == 'release'
-        env:
-          TAG: ${{ github.event.release.tag_name }}
-        run: |
-          VERSION=$(node -p "require('./package.json').version")
-          if [ "${TAG#v}" != "$VERSION" ]; then
-            echo "::error::Release tag $TAG does not match package.json version $VERSION"
-            exit 1
-          fi
-
-      - name: Publish
-        run: |
-          npm publish
+    with:
+      package-manager: npm

package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopback-component-flatstorage",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "loopback component for attaching to various cloud storage providers with ACL functionality",
   "main": "index.js",
   "files": [