fix: downgrade date-fns to v3.x for CommonJS compatibility

date-fns v4.x is ESM-only which causes 'Cannot destructure property differenceInHours' error when used with CommonJS bundling in Strapi plugins.

Author: Schero94

.github/workflows/npm-publish.yml

@@ -4,9 +4,12 @@ on:
   release:
     types: [published]
 
+# OIDC Trusted Publishing - npm provenance for signed/verified packages
+# See: https://docs.npmjs.com/generating-provenance-statements
+
 permissions:
-  id-token: write  # Required for NPM OIDC
-  contents: write  # Required for Version Bump
+  contents: write      # Required for version bump commit
+  id-token: write      # Required for NPM OIDC provenance
 
 jobs:
   publish:
@@ -20,38 +23,42 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          always-auth: true
-          node-version: 22
-          cache: 'npm'
-          registry-url: 'https://registry.npmjs.org/'
-
-      - name: Update NPM CLI to latest
-        run: npm i -g npm@latest
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
         run: npm ci
 
-      - name: Build the plugin
+      - name: Build plugin
         run: npm run build
 
-      - name: Verify plugin
+      - name: Verify plugin structure
         run: npm run verify
 
-      - name: Get the release tag version
-        id: get_version
-        run: echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT
+      - name: Get release version
+        id: version
+        run: |
+          RELEASE_TAG="${{ github.event.release.tag_name }}"
+          VERSION="${RELEASE_TAG#v}"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "[INFO] Release version: $VERSION"
 
-      - name: Set package version
-        run: npm version "${{ steps.get_version.outputs.VERSION }}" --no-git-tag-version
+      - name: Update package version
+        run: npm version "${{ steps.version.outputs.version }}" --no-git-tag-version
 
-      - name: Publish package
+      - name: Publish to NPM with provenance
         run: npm publish --access public --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Push version bump
         uses: stefanzweifel/git-auto-commit-action@v5
         with:
-          commit_message: 'chore: Bump version to ${{ steps.get_version.outputs.VERSION }}'
+          commit_message: 'chore: bump version to ${{ steps.version.outputs.version }}'
           file_pattern: 'package.json package-lock.json'
           branch: main
+      - name: Done
+        run: |
+          PKG_NAME=$(node -p "require('./package.json').name")
+          echo "[SUCCESS] Published $PKG_NAME@${{ steps.version.outputs.version }} with provenance"
+