ci: fix the release flow through Trusted Publishing

fred-venus · fred-venus · commit 6ab87cb5f1e3 · 2025-12-12T13:48:39.000+08:00
diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml
@@ -6,6 +6,10 @@ on:
       - main
       - develop
 
+permissions:
+  id-token: write # Required for OIDC
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -19,6 +23,8 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           cache: "yarn"
+          node-version: "22.14.0"
+          registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
         run: yarn
@@ -29,7 +35,6 @@ jobs:
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.VENUS_TOOLS_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           GIT_AUTHOR_NAME: Venus Tools
           GIT_AUTHOR_EMAIL: tools@venus.io
           GIT_COMMITTER_NAME: Venus Tools
diff --git a/package.json b/package.json
@@ -66,9 +66,8 @@
     "@nomicfoundation/hardhat-chai-matchers": "^1.0.3",
     "@nomicfoundation/hardhat-network-helpers": "^1.0.4",
     "@nomicfoundation/hardhat-verify": "^2.0.14",
-    "@semantic-release/changelog": "^6.0.1",
+    "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
-    "@semantic-release/npm": "^9.0.1",
     "@trivago/prettier-plugin-sort-imports": "3.4.0",
     "@typechain/ethers-v5": "^7.2.0",
     "@typechain/hardhat": "^2.3.1",
@@ -99,7 +98,7 @@
     "husky": "^8.0.1",
     "prettier": "2.7.1",
     "prettier-plugin-solidity": "1.1.3",
-    "semantic-release": "^19.0.3",
+    "semantic-release": "^25.0.2",
     "solhint": "^3.3.7",
     "solidity-coverage": "^0.8.4",
     "solidity-docgen": "^0.6.0-beta.29",
diff --git a/yarn.lock b/yarn.lock
