From 259b344c5c9fdd6542688636e1244f4529cabb79 Mon Sep 17 00:00:00 2001
From: mlischetti <lischettim@gmail.com>
Date: Thu, 17 Sep 2026 16:31:22 -0300
Subject: [PATCH 1/3] Use OIDC for Node promotion publishing

---
 .github/workflows/promote-release.yml | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/promote-release.yml b/.github/workflows/promote-release.yml
index d3934d6..f139339 100644
--- a/.github/workflows/promote-release.yml
+++ b/.github/workflows/promote-release.yml
@@ -122,11 +122,17 @@ jobs:
   node:
     if: inputs.artifact == 'node' || inputs.artifact == 'all'
     runs-on: mulesoft-ubuntu
+    permissions:
+      contents: read
+      # Lets npm exchange GitHub's short-lived OIDC token for publish credentials.
+      id-token: write
     steps:
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
           registry-url: https://registry.npmjs.org
+      - name: Upgrade npm for OIDC trusted publishing support
+        run: npm install -g npm@latest
       - name: Verify Node package versions are not published
         env:
           TAG: ${{ inputs.tag }}
@@ -214,10 +220,9 @@ jobs:
               }
             ' "$PACKAGE" "$VERSION"
           done
-      - name: Publish Node packages
+      - name: Publish Node packages via OIDC trusted publishing
         if: inputs.dry_run == false
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           TAG: ${{ inputs.tag }}
           RELEASE_DIR: ${{ env.RELEASE_DIR }}
         run: |
@@ -228,5 +233,7 @@ jobs:
             "dataweave-native-win32-x64-${VERSION}.tgz" \
             "dataweave-native-darwin-arm64-${VERSION}.tgz" \
             "dataweave-native-${VERSION}.tgz"; do
-            npm publish "$RELEASE_DIR/$ASSET" --access public
+            # These tarballs are built by the release workflow, so promotion does
+            # not attach provenance for the download-and-publish step.
+            npm publish "$RELEASE_DIR/$ASSET" --access public --provenance=false
           done

From d775da335d903cd37eaf3ee3d4d72f450d2c79c1 Mon Sep 17 00:00:00 2001
From: mlischetti <lischettim@gmail.com>
Date: Thu, 17 Sep 2026 16:55:40 -0300
Subject: [PATCH 2/3] Rename release promotion workflow

---
 .../{promote-release.yml => promote-release-artifacts.yml}        | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename .github/workflows/{promote-release.yml => promote-release-artifacts.yml} (100%)

diff --git a/.github/workflows/promote-release.yml b/.github/workflows/promote-release-artifacts.yml
similarity index 100%
rename from .github/workflows/promote-release.yml
rename to .github/workflows/promote-release-artifacts.yml

From 4f9d3025541a15e1fb8773657b4a52562d5b960f Mon Sep 17 00:00:00 2001
From: mlischetti <lischettim@gmail.com>
Date: Thu, 17 Sep 2026 16:56:14 -0300
Subject: [PATCH 3/3] Name release artifact promotion workflow

---
 .github/workflows/promote-release-artifacts.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/promote-release-artifacts.yml b/.github/workflows/promote-release-artifacts.yml
index f139339..18814b8 100644
--- a/.github/workflows/promote-release-artifacts.yml
+++ b/.github/workflows/promote-release-artifacts.yml
@@ -1,4 +1,4 @@
-name: Promote release
+name: Promote release artifacts
 
 on:
   workflow_dispatch: