From 1cab75c2ef555126949153ef3bf8fbc6276020e9 Mon Sep 17 00:00:00 2001
From: Darius Cepulis <dcepulis@mux.com>
Date: Thu, 26 Feb 2026 15:21:38 -0600
Subject: [PATCH] feat(cd): switch to npm trusted publishers

Replace NPM_TOKEN with OIDC-based trusted publishing. Bump Node to
24 LTS (bundles npm 11 which supports OIDC). Add @videojs/store and
@videojs/element to release-please config.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/release-please/.release-please-manifest.json |  4 +++-
 .github/release-please/release-please-config.json    | 12 +++++++++++-
 .github/workflows/cd.yml                             | 10 +---------
 .github/workflows/ci.yml                             |  2 +-
 .nvmrc                                               |  2 +-
 packages/element/package.json                        |  2 +-
 packages/store/package.json                          |  2 +-
 7 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/.github/release-please/.release-please-manifest.json b/.github/release-please/.release-please-manifest.json
index 691e04c0..9971d5dd 100644
--- a/.github/release-please/.release-please-manifest.json
+++ b/.github/release-please/.release-please-manifest.json
@@ -1,7 +1,9 @@
 {
   "packages/core": "10.0.0-alpha.1",
+  "packages/element": "10.0.0-alpha.1",
   "packages/html": "10.0.0-alpha.1",
-  "packages/react": "10.0.0-alpha.1",
   "packages/icons": "10.0.0-alpha.1",
+  "packages/react": "10.0.0-alpha.1",
+  "packages/store": "10.0.0-alpha.1",
   "packages/utils": "10.0.0-alpha.1"
 }
diff --git a/.github/release-please/release-please-config.json b/.github/release-please/release-please-config.json
index bb289ce4..16068b95 100644
--- a/.github/release-please/release-please-config.json
+++ b/.github/release-please/release-please-config.json
@@ -12,7 +12,7 @@
     {
       "type": "linked-versions",
       "groupName": "videojs",
-      "components": ["@videojs/core", "@videojs/html", "@videojs/icons", "@videojs/react", "@videojs/utils"]
+      "components": ["@videojs/core", "@videojs/element", "@videojs/html", "@videojs/icons", "@videojs/react", "@videojs/store", "@videojs/utils"]
     }
   ],
   "packages": {
@@ -21,6 +21,11 @@
       "prerelease": true,
       "versioning": "prerelease"
     },
+    "packages/element": {
+      "component": "@videojs/element",
+      "prerelease": true,
+      "versioning": "prerelease"
+    },
     "packages/html": {
       "component": "@videojs/html",
       "prerelease": true,
@@ -36,6 +41,11 @@
       "prerelease": true,
       "versioning": "prerelease"
     },
+    "packages/store": {
+      "component": "@videojs/store",
+      "prerelease": true,
+      "versioning": "prerelease"
+    },
     "packages/utils": {
       "component": "@videojs/utils",
       "prerelease": true,
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 3af1a0a1..6608782a 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -39,16 +39,10 @@ jobs:
         if: ${{ steps.release.outputs.releases_created == 'true' }}
         uses: pnpm/action-setup@v4
 
-      - name: read node version from the .nvmrc file
-        if: ${{ steps.release.outputs.releases_created == 'true' }}
-        run: echo ::set-output name=NODE_VERSION::$(cat .nvmrc)
-        shell: bash
-        id: nvmrc
       - uses: actions/setup-node@v5
         if: ${{ steps.release.outputs.releases_created == 'true' }}
         with:
-          node-version: ${{steps.nvmrc.outputs.NODE_VERSION}}
-          # this line is required for the setup-node action to be able to run the npm publish below.
+          node-version-file: '.nvmrc'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install
@@ -75,5 +69,3 @@ jobs:
       - name: Publish
         if: ${{ steps.release.outputs.releases_created == 'true' }}
         run: pnpm -r publish --filter "./packages/*" publish --access public --provenance --tag next --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 77b634e8..3d195202 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v5
         with:
-          node-version: 22
+          node-version-file: '.nvmrc'
           cache: pnpm
 
       - name: Install dependencies
diff --git a/.nvmrc b/.nvmrc
index e2228113..d845d9d8 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-22.19.0
+24.14.0
diff --git a/packages/element/package.json b/packages/element/package.json
index 5a1337d7..8b510b50 100644
--- a/packages/element/package.json
+++ b/packages/element/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@videojs/element",
   "type": "module",
-  "version": "0.1.0-alpha.1",
+  "version": "10.0.0-alpha.1",
   "description": "Lightweight reactive custom element base for Video.js",
   "license": "Apache-2.0",
   "main": "dist/default/index.js",
diff --git a/packages/store/package.json b/packages/store/package.json
index de9a4741..41c98da2 100644
--- a/packages/store/package.json
+++ b/packages/store/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@videojs/store",
   "type": "module",
-  "version": "0.1.0-alpha.1",
+  "version": "10.0.0-alpha.1",
   "description": "Reactive state management for external systems.",
   "license": "Apache-2.0",
   "main": "dist/default/index.js",