Merge pull request #27 from microsoft/ljoy/update-build-dependencies #1

	# Publishes @microsoft/msrcrypto to npm.
	#
	# Dormant until you cut a release: it runs only when a GitHub Release is
	# published or a v* tag is pushed. It builds, verifies the package contents,
	# then publishes with npm provenance (supply-chain attestation).
	#
	# Note: the QUnit suite (test/SubtleTests.html) is a manual, real-browser
	# harness (it targets IE8+ behavior) and is intentionally not run here.
	#
	# Prerequisites (one-time, when you are ready to publish):
	# - Add an npm automation token as the repository secret NPM_TOKEN, OR
	# configure npm Trusted Publishing (OIDC) and drop the NODE_AUTH_TOKEN env.
	# - The `id-token: write` permission below is required for --provenance.
	name: Publish

	on:
	release:
	types: [published]
	push:
	tags:
	- "v*"

	permissions:
	contents: read
	id-token: write # required for npm --provenance

	jobs:
	publish:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v5

	- name: Setup Node.js
	uses: actions/setup-node@v5
	with:
	node-version: 22
	registry-url: https://registry.npmjs.org

	- name: Install dependencies
	run: npm ci

	- name: Build
	run: npm run build

	- name: Verify package contents
	run: npm pack --dry-run

	- name: Publish to npm
	run: npm publish --provenance --access public
	env:
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Navigation Menu