chore(actions): harden release action and clean up ci (#966)

.github/workflows/ci.yml

@@ -98,7 +98,7 @@ jobs:
  cache: 'pnpm'
  cache-dependency-path: '**/pnpm-lock.yaml'
  - name: install
- run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts
+ run: pnpm install --frozen-lockfile --ignore-scripts
  - name: install playwright chromium
  run: pnpm playwright install chromium
  - name: run tests

.github/workflows/release.yml

@@ -56,17 +56,17 @@ jobs:
  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
  - name: Create Release Pull Request or Publish to npm
  id: changesets
- uses: changesets/action@v1
+ # pinned for security, always review third party action code before updating
+ uses: changesets/action@aba318e9165b45b7948c60273e0b72fce0a64eb9 #v1.4.7
  with:
  # This expects you to have a script called release which does a build for your packages and calls changeset publish
  publish: pnpm release
  env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
  NPM_CONFIG_PROVENANCE: true
-
- # TODO alert discord
- # - name: Send a Slack notification if a publish happens
- # if: steps.changesets.outputs.published == 'true'
- # # You can do something when a publish happens.
- # run: my-slack-bot send-notification --message "A new version of ${GITHUB_REPOSITORY} was published!"
+ - name: Remove .npmrc
+ if: always()
+ run: |
+ echo "#deleted" > "$HOME/.npmrc"
+ rm -f "$HOME/.npmrc"