fix: publish shrinkwrap with prod dependencies only

.github/workflows/release-please.yml

@@ -4,41 +4,47 @@ on:
     branches:
       - main
 jobs:
-  release-please:
+  create-release:
     runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
     steps:
       - uses: navikt/github-app-token-generator@a3831f44404199df32d8f39f7c0ad9bb8fa18b1c
         id: get-token
         with:
           private-key: ${{ secrets.TOKENS_PRIVATE_KEY }}
           app-id: ${{ secrets.TOKENS_APP_ID }}
+
       - uses: GoogleCloudPlatform/release-please-action@v3
         id: release
         with:
           token: ${{ steps.get-token.outputs.token }}
           release-type: node
-          package-name: 'netlify-cli'
+          package-name: netlify-cli
+
+  publish:
+    runs-on: ubuntu-latest
+    needs: create-release
+    if: ${{ needs.create-release.outputs.release_created }}
+    steps:
       - uses: actions/checkout@v3
-        if: ${{ steps.release.outputs.release_created }}
+
       - uses: actions/setup-node@v3
         with:
-          node-version: '*'
-          cache: 'npm'
-          cache-dependency-path: 'npm-shrinkwrap.json'
-          check-latest: true
+          node-version: lts/*
+          cache: npm
           registry-url: 'https://registry.npmjs.org'
-        if: ${{ steps.release.outputs.release_created }}
-      # required for linting to pass
-      - name: Install site dependencies
-        run: npm run site:build:install
-        if: ${{ steps.release.outputs.release_created }}
+
       - name: Install core dependencies
         run: npm ci --no-audit
-        if: ${{ steps.release.outputs.release_created }}
+
+      # https://github.com/ossf/package-manager-best-practices/issues/35#issue-1360805761
+      - name: Create shrinkwrap
+        run: |
+          npm prune --production
+          rm -rf package-lock.json
+          npm shrinkwrap
+
       - run: npm publish
-        if: ${{ steps.release.outputs.release_created }}
         env:
           NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-          # required for tests to pass
-          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
-          NETLIFY_TEST_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}