Bump workflows

.github/workflows/release.yml

@@ -1,22 +1,10 @@
 name: Release
 on:
   push: { tags: 'v[0-9]+.[0-9]+.[0-9]+*' }
-
-permissions: { contents: read }
+permissions: {}
 
 jobs:
-  github:
-    permissions: { contents: write }
-    uses: nodenv/.github/.github/workflows/release.yml@v3
-
-  npm:
-    runs-on: ubuntu-latest
-    permissions: { id-token: write }
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm publish --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPMJS_TOKEN }}
+  release:
+    permissions: {contents: write, id-token: write}
+    uses: nodenv/.github/.github/workflows/release.yml@v4
+    secrets: inherit

.github/workflows/sync-main-master.yml → .github/workflows/sync-default-branch.yml

@@ -2,8 +2,12 @@ name: Sync Default Branch
 on:
   push: { branches: main }
   workflow_dispatch:
+permissions: {contents: read}
 
-permissions: { contents: read }
+jobs:
+  sync:
+    permissions: {contents: write}
+    uses: nodenv/.github/.github/workflows/sync-default-branch.yml@v4
 
 # One-time commands for users to switch-over:
 #
@@ -13,8 +17,3 @@ permissions: { contents: read }
 # git branch -u origin/main main
 # git remote set-head origin -a
 # ```
-
-jobs:
-  sync:
-    permissions: { contents: write }
-    uses: nodenv/.github/.github/workflows/sync-default-branch.yml@v3

.github/workflows/tag-major.yml

@@ -2,10 +2,9 @@ name: Tag Major Version
 on:
   push: { tags: "v*.*.*" }
   workflow_dispatch:
-
-permissions: { contents: read }
+permissions: {}
 
 jobs:
   tag:
-    permissions: { contents: write }
-    uses: nodenv/.github/.github/workflows/tag-major.yml@v3
+    permissions: {contents: write}
+    uses: nodenv/.github/.github/workflows/tag-major.yml@v4

.github/workflows/test.yml

@@ -1,19 +1,26 @@
 name: Test
-on: [push, pull_request, workflow_dispatch]
-
-permissions: { contents: read }
+on:
+  pull_request:
+  push: {branches: main}
+  schedule: [{cron: '0 0 10 * *'}] # monthly https://crontab.guru/#0_0_10_*_*
+  workflow_dispatch:
+permissions: {contents: read}
 
 jobs:
   test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: npm cit
+    uses: nodenv/.github/.github/workflows/test.yml@v4
+    with: {superlinter: false} # TODO renable superlinter
+    permissions:
+      contents: read
+      packages: read
+      id-token: write
+      security-events: write
+      statuses: write
 
-  lint:
+  superlinter:
     runs-on: ubuntu-latest
     if: github.ref_name != github.event.repository.default_branch
-    permissions: { statuses: write }
+    permissions: {statuses: write}
     steps:
       - uses: actions/checkout@v4
         with: { fetch-depth: 0 } # super-linter needs full git history