feat: revamp package author check for potential package compromise #660

	name: CI

	on: [push, pull_request]

	jobs:
	build:
	strategy:
	matrix:
	platform: [ubuntu-latest]
	node: ['18', '20']
	name: Node ${{ matrix.node }} (${{ matrix.platform }})
	runs-on: ${{ matrix.platform }}
	steps:
	- uses: actions/checkout@v2
	- uses: actions/setup-node@v2
	with:
	node-version: ${{ matrix.node }}
	- name: install dependencies
	run: npm ci --ignore-engines --ignore-scripts
	- name: lint code
	run: npm run lint
	env:
	CI: true
	- name: run tests
	run: npm run test
	env:
	CI: true
	- name: coverage
	uses: codecov/codecov-action@v1
	with:
	fail_ci_if_error: true
	verbose: false
	env:
	CODECOV_TOKEN: ${{secrets.CODECOV_TOKEN}}
	CI: true

	release:
	name: do semantic release
	runs-on: 'ubuntu-latest'
	permissions:
	contents: write # to be able to publish a GitHub release
	issues: write # to be able to comment on released issues
	pull-requests: write # to be able to comment on released pull requests
	id-token: write # to enable use of OIDC for npm provenance
	needs: build
	if: github.event_name == 'push' && github.ref == 'refs/heads/main'
	steps:
	- uses: actions/checkout@v2
	- uses: actions/setup-node@v2
	with:
	node-version: '18'
	- name: install dependencies
	run: npm ci --ignore-engines --ignore-scripts
	- name: release
	run: npx semantic-release
	env:
	GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
	NPM_TOKEN: ${{secrets.NPM_TOKEN}}

Provide feedback