ci(corepack): pinned the expected dev version of npm and explicitly u…

…sed it for audit signatures (#895)

* ci(corepack): pinned the expected dev version of npm and explicitly used it for audit signatures

* ci(matrix): added job to ensure the full matrix succeeds, enabling proper required enforcement

* test(publish): verify details of the published package

.github/workflows/node-ci.yml

@@ -26,7 +26,7 @@ jobs:
           cache: npm
       - run: npm clean-install
       - run: npm test
-  verify:
+  verify-dev:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -36,4 +36,18 @@ jobs:
           node-version-file: .nvmrc
           cache: npm
       - run: npm clean-install
+      - run: corepack npm audit signatures
       - run: npm test
+  verify:
+    runs-on: ubuntu-latest
+    needs:
+      - verify-dev
+      - verify-matrix
+    if: ${{ !cancelled() }}
+    steps:
+      - name: All matrix versions passed
+        if: ${{ !(contains(needs.*.result, 'failure')) }}
+        run: exit 0
+      - name: Some matrix version failed
+        if: ${{ contains(needs.*.result, 'failure') }}
+        run: exit 1

.github/workflows/release.yml

@@ -22,7 +22,7 @@ jobs:
           node-version-file: .nvmrc
           cache: npm
       - run: npm clean-install
-      - run: npm audit signatures
+      - run: corepack npm audit signatures
       - run: npx semantic-release@23.0.6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package.json

@@ -13,6 +13,7 @@
     "lint:lockfile": "lockfile-lint --path package-lock.json --type npm --validate-https --allowed-hosts npm",
     "lint:engines": "ls-engines",
     "lint:peer": "npm ls >/dev/null",
+    "lint:publish": "publint --strict",
     "test:unit": "jest 'test/unit/'",
     "test:unit:watch": "npm run test:unit -- --watch",
     "test:integration": "run-s 'test:integration:base -- --profile noWip'",
@@ -43,6 +44,7 @@
     "nodemon": "3.1.0",
     "npm-run-all2": "6.1.2",
     "prettier-standard": "16.4.1",
+    "publint": "0.2.7",
     "smee-client": "2.0.1",
     "standard": "17.1.0"
   },
@@ -71,5 +73,6 @@
   "publishConfig": {
     "access": "public",
     "provenance": true
-  }
+  },
+  "packageManager": "npm@10.5.0+sha256.17ca6e08e7633b624e8f870db81a78f46afe119de62bcaf0a7407574139198fc"
 }