ci: update release config

.github/workflows/release.yml

@@ -1,35 +1,51 @@
 name: Release
 on:
-  repository_dispatch:
-    # curl -v -H "Accept: application/vnd.github.everest-preview+json" -H "Authorization: token ${GH_TOKEN}"
-    # https://api.github.com/repos/bent10/doogu/dispatches -d '{ "event_type": "semantic-release" }'
-    types: [semantic-release]
   push:
     branches:
       - main
       - next
-      - next-major
-      - beta
-      - alpha
-      - '*.x'
+
+permissions:
+  contents: read # for checkout
 
 jobs:
   release:
     name: Releasing
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
-          node-version: 20.8.1 # required by semantic-release
-      - run: npm i
-      - run: npm test
+          node-version: 'lts/*'
+
+      - name: Install dependencies
+        run: npm clean-install
+
+      - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies
+        run: npm audit signatures
+
+      - name: Test and building
+        run: |
+          npm run lint
+          npm run build
+          npm test
 
-      - name: Installing release dependencies
-        run: npm i -g semantic-release @semantic-release/changelog @semantic-release/git
+      - name: Install release dependencies
+        run: |
+          npm i -g semantic-release @semantic-release/changelog @semantic-release/git
 
       - name: Semantic release
         env:
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: semantic-release
+        run: npx semantic-release