Maintenance: Add registry-url to setup-node steps to fix Scorecard packaging check

[dreamorosi]

Summary

The OSSF Scorecard packaging check is currently failing with an "inconclusive" result (-1 score) because our GitHub Actions workflows don't match the expected pattern for NPM publishing workflows. While our workflows correctly publish packages to NPM, they use npm set to configure the registry instead of the registry-url parameter that Scorecard specifically looks for.

Why is this needed?

We use OSSF Scorecard to continuously evaluate our project against various security practices. Our current packaging check failure affects our overall security score and may impact user confidence in the project's security posture.

After reviewing the scorecard repo, the packaging check specifically looks for:

1. actions/setup-node with registry-url: 'https://registry.npmjs.org'
2. An npm.*publish command

We have #2 but are missing #1. The check's pattern matching is rigid and doesn't recognize our current authentication method using npm set.

Solution

Add the registry-url: 'https://registry.npmjs.org' parameter to the actions/setup-node steps in:

• .github/workflows/make-release.yml
• .github/workflows/publish-package.yml

Example change:

- name: Setup NodeJS
  uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
  with:
    node-version: "22"
    cache: "npm"
    registry-url: 'https://registry.npmjs.org'  # Add this line

This change is purely additive and won't affect the existing npm set authentication method. It will allow Scorecard to properly detect our packaging workflow and improve our security score.

While we're at it, let's also update the OSSF Scorecard badge url in the main README file to use this link: https://scorecard.dev/viewer/?uri=github.com/aws-powertools/powertools-lambda-typescript

Right now it uses a JSON link that it's pretty hard to parse, but this rendered one is better.

Acknowledgment

• This request meets Powertools for AWS Lambda (TypeScript) Tenets
• Should this be considered in other Powertools for AWS Lambda languages? i.e. Python, Java, and .NET

Future readers

Please react with 👍 and your use case to help us understand customer demand.

[powertools-for-aws-oss-automation]

Note

For those interested in contributing, please leave a comment below so that we can assign the issue to you and make sure we don't duplicate efforts. If you have any further questions, please don't hesitate to ask below or on our Discord server.

[shrivarshapoojari]

Hi,
I would like to work on this issue.
Could you please assign this to me?
Thanks

[sdangol]

Thanks @shrivarshapoojari, I've assigned it to you

[shrivarshapoojari]

Hi @sdangol raised PR.
Please let me know if any changes required.
Thanks