chore: Update GitHub Actions workflows to use trusted publishers and latest action versions (#265)

* Initial plan

* Update GitHub Actions workflows to use trusted publishers

Co-authored-by: kentcdodds <[email protected]>

* Update node-version to use LTS aliases for future-proofing

Co-authored-by: kentcdodds <[email protected]>

* Update .github/workflows/validate.yml

* Update .github/workflows/validate.yml

* Apply suggestion from @kentcdodds

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: kentcdodds <[email protected]>
Co-authored-by: Kent C. Dodds <[email protected]>

Author: Copilot

.github/workflows/auto-format.yml

@@ -20,15 +20,15 @@ jobs:
       pull-requests: write
     steps:
       - name: 📥 Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           ref: ${{ github.head_ref || github.ref_name }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 24
+          node-version: lts/*
           cache: 'npm'
 
       - name: Cache node_modules

.github/workflows/validate.yml

@@ -16,14 +16,14 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [22, 24]
+        node-version: [lts/-1, lts/*, latest]
 
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: 🟢 Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -62,14 +62,14 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest]
-        node-version: [24]
+        node-version: [lts/*]
 
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: 🟢 Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -97,26 +97,31 @@ jobs:
     name: 🚀 Release
     needs: [build, e2e]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      id-token: write # to enable use of OIDC for npm provenance
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
     if:
       ${{ github.repository == 'kentcdodds/cross-env' &&
       contains('refs/heads/main,refs/heads/beta,refs/heads/next,refs/heads/alpha',
       github.ref) && github.event_name == 'push' }}
     steps:
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: 🔄 Restore build output
         uses: actions/cache/restore@v4
         with:
           path: |
             dist/
-          key: build-24-${{ github.sha }}
+          key: build-lts/*-${{ github.sha }}
           fail-on-cache-miss: false
 
       - name: 🚀 Release
-        uses: cycjimmy/semantic-release-action@v4
+        uses: cycjimmy/semantic-release-action@v5.0.2
         with:
-          semantic_version: 24
+          semantic_version: 25
           branches: |
             [
               '+([0-9])?(.{+([0-9]),x}).x',
@@ -128,4 +133,3 @@ jobs:
             ]
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}