ci(release): use a github app to semantic-release

.github/workflows/release.yaml

@@ -5,30 +5,43 @@ on:
     branches: [main, next]
 
 env:
-  SEMANTIC_RELEASE_VERSION: 22.0.8
+  SEMANTIC_RELEASE_VERSION: 22.0.12
 
 jobs:
   release:
     name: Semantic release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      issues: write
+      pull-requests: write
     steps:
+      - name: Gandalf
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ vars.GANDALF_APP_ID }}
+          private-key: ${{ secrets.GANDALF_PRIVATE_KEY }}
       - name: Checkout
         uses: actions/checkout@v4
         with:
           # Needs to fetch historical commits in order to compare with origin/main
           fetch-depth: 0
-          persist-credentials: false
+          token: ${{ steps.app-token.outputs.token }}
       - name: Setup Node.js environment
         uses: actions/setup-node@v4
         with:
           node-version: 20
           cache: yarn
       - name: Install dependencies
         run: yarn install --immutable --immutable-cache --check-cache
+      - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies
+        run: npm audit signatures
       - name: Semantic release
         env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_ENV: production
           HUSKY: 0
         run: |
           yarn dlx --package @semantic-release/commit-analyzer --package @semantic-release/release-notes-generator --package @semantic-release/npm --package @semantic-release/github --package @semantic-release/git --package @semantic-release/changelog --package semantic-release@${{ env.SEMANTIC_RELEASE_VERSION }} semantic-release

.github/workflows/validate.yaml

@@ -1,8 +1,6 @@
 name: Validate
 
 on:
-  push:
-    branches: [main, next]
   pull_request:
     types: [opened, synchronize]
 
@@ -23,11 +21,9 @@ jobs:
           cache: yarn
       - name: Install dependencies
         run: yarn install --immutable --immutable-cache --check-cache
-
       - name: Validate current commit (last commit) with commitlint
         if: github.event_name == 'push'
         run: yarn dlx commitlint --from HEAD~1 --to HEAD --verbose
-
       - name: Validate PR commits with commitlint
         if: github.event_name == 'pull_request'
         run: npx commitlint --from ${{ github.event.pull_request.head.sha }}~${{ github.event.pull_request.commits }} --to ${{ github.event.pull_request.head.sha }} --verbose