Update package URLs, update action permissions

.github/workflows/release.yaml

@@ -2,11 +2,14 @@ name: NPM CI release
 on:
   release:
     types: [created]
+  workflow_call:
 
 jobs:
   build:
     name: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -26,8 +29,9 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     permissions:
-      id-token: write
       attestations: write
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -41,23 +45,26 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     permissions:
-      id-token: write
       attestations: write
+      contents: read
+      id-token: write
       packages: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 20
           registry-url: 'https://npm.pkg.github.com'
-      - run: npm publish --provenance
+      - run: npm publish
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-  publish-webjar-test-echo:
+  publish-webjar:
     needs: publish-npm-registry-npmjs
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
-      - run: echo curl "https://www.webjars.org/deploy?webJarType=npm&nameOrUrlish=tag2link&version=$(jq -r '.version' package.json)"
+      - run: curl "https://www.webjars.org/deploy?webJarType=npm&nameOrUrlish=tag2link&version=$(jq -r '.version' package.json)"
 

.github/workflows/scheduled_update.yaml

@@ -53,11 +53,14 @@ jobs:
     needs: update
     env:
       GH_TOKEN: ${{ github.token }}
+    outputs:
+      release_needed: ${{ steps.tag.outputs.release_needed }}
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - run: |
+      - id: tag
+        run: |
           gh repo sync
           tag=$(git describe --tags --abbrev=0) || release_needed="true"
           sha=${{ needs.update.outputs.sha }}
@@ -85,4 +88,17 @@ jobs:
               --field "ref=refs/tags/${tag}" \
               --field "sha=${object}"
             gh release create ${tag} --generate-notes
-          fi
+            echo "release_needed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "release_needed=false" >> "$GITHUB_OUTPUT"
+          fi
+  publish:
+    needs: tag
+    if: needs.tag.outputs.release_needed
+    uses: .github/workflows/release.yaml
+    secrets: inherit
+    permissions:
+      attestations: write
+      contents: read
+      id-token: write
+      packages: write

package.json

@@ -13,10 +13,10 @@
   "scripts": {
     "build": "npx ts-node build.ts"
   },
-  "homepage": "https://github.com/osmlab/tag2link",
+  "homepage": "https://github.com/JOSM/tag2link",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/osmlab/tag2link.git"
+    "url": "https://github.com/JOSM/tag2link"
   },
   "author": "Simon Legner <[email protected]>",
   "license": "ISC",