4.1.0: unit support, publish with npm trusted publishing

.github/workflows/npm-publish.yml

@@ -1,5 +1,7 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
+# Tests every push and pull request; publishes to npm when main has a
+# package.json version newer than the one on npm.
+# Publishing uses npm trusted publishing (OIDC): no token, npm trusts this
+# workflow file (npm-publish.yml) of edge-ml/javascript.
 
 name: Node.js Package
 
@@ -12,6 +14,8 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -27,7 +31,12 @@ jobs:
 
   publish-npm:
     needs: build
+    # only from main, never from a pull request
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # OIDC token for npm trusted publishing
     steps:
       - uses: actions/checkout@v4
       - id: check
@@ -39,15 +48,15 @@ jobs:
       - uses: actions/setup-node@v4
         if: steps.check.outputs.changed == 'true'
         with:
-          node-version: 20
-          registry-url: https://registry.npmjs.org/
+          node-version: 24
+      # trusted publishing needs npm >= 11.5.1
+      - run: npm install -g npm@^11.5.1 && npm --version
+        if: steps.check.outputs.changed == 'true'
       - run: npm ci
         if: steps.check.outputs.changed == 'true'
         env:
           ONNXRUNTIME_NODE_INSTALL_CUDA: skip
       - run: npm publish
         if: steps.check.outputs.changed == 'true'
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.npm_token}}
       - name: Version unchanged
         run: 'echo "${{steps.check.outputs.changed}}"'

README.md

@@ -220,7 +220,7 @@ catalog.quantities.map((q) => [q.id, q.defaultUnit, q.units.map((u) => u.id)]);
 // [["acceleration", "m/s^2", ["m/s^2", "g", "mg", "cm/s^2"]], ["angular_velocity", "deg/s", ["deg/s", "rad/s", "rpm"]], ...]
 ```
 
-## Unreleased: units
+## 4.1.0: units
 
 - Time-series can carry a unit and quantity when uploading (`{ name, unit, quantity }` instead of a name).
 - `OnnxPredictor` converts declared sensor units to the units the model expects (`units` option, `setUnits`, `inputUnits`), and throws a `UnitError` for units it can't convert.

package.json

@@ -1,6 +1,6 @@
 {
     "name": "edge-ml",
-    "version": "4.0.1",
+    "version": "4.1.0",
     "description": "JavaScript library for edge-ml (https://github.com/edge-ml): collect data, train models and run them in the browser or Node.js",
     "main": "dist/index.js",
     "module": "dist/index.mjs",