fix(publish-npm): use github provider because the PROVENANCE require github self hosted runner

deps(deps): bump actions/setup-node in the github-actions group

Bumps the github-actions group with 1 update: [actions/setup-node](https://github.com/actions/setup-node).


Updates `actions/setup-node` from 4 to 5
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/build-lint-test.yaml

@@ -2,6 +2,10 @@
 
 name: Build, Lint, and Test Project
 
+# Required permission on the caller workflow
+# permissions:
+#   contents: read
+
 on:
   workflow_call:
     inputs:
@@ -11,22 +15,20 @@ on:
         default: 'lts/*'
         type: string
 
-permissions:
-  contents: read
-
 jobs:
   main:
     name: Build, Lint, and Test Project
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
 
     steps:
       - name: 📥 Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
-          node-version: ${{ inputs.NODE_VERSION }}
+          node-version: ${{ inputs.node-version }}
+          package-manager-cache: false
 
       - name: 🛠️ Setup Node.js Corepack
         run: corepack enable
@@ -43,6 +45,14 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-yarn-
 
+      - name: 🗂️ Cache .cache folders
+        uses: actions/cache@v4
+        with:
+          path: packages/**/.cache
+          key: ${{ runner.os }}-cache
+          restore-keys: |
+            ${{ runner.os }}-cache-
+
       - name: 📥 Install Dependencies
         run: yarn install --immutable
 

.github/workflows/codeql.yaml

@@ -2,18 +2,19 @@
 
 name: CodeQL
 
+# Required permission on the caller workflow
+# permissions:
+#   actions: read
+#   contents: read
+#   security-events: write
+
 on:
   workflow_call:
 
-permissions:
-  actions: read
-  contents: read
-  security-events: write
-
 jobs:
   main:
     name: CodeQL Analyze
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
 
     strategy:
       fail-fast: false
@@ -23,7 +24,7 @@ jobs:
 
     steps:
       - name: ⤵️ Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: 🏗 Initialize CodeQL
         uses: github/codeql-action/init@v3

.github/workflows/dependency-review.yaml

@@ -2,6 +2,10 @@
 
 name: Dependency Review
 
+# Required permission on the caller workflow
+# permissions:
+#   contents: read
+
 on:
   workflow_call:
     inputs:
@@ -16,17 +20,14 @@ on:
         type: string
         default: 'next'
 
-permissions:
-  contents: read
-
 jobs:
   main:
     name: Dependency Review
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
 
     steps:
       - name: ⤵️ Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: 🚀 Dependency Review
         uses: actions/dependency-review-action@v4

.github/workflows/publish-npm.yaml

@@ -2,6 +2,11 @@
 
 name: Publish NPM
 
+# Required permission on the caller workflow
+# permissions:
+#   contents: read
+#   id-token: write
+
 on:
   workflow_call:
     inputs:
@@ -20,10 +25,6 @@ on:
         required: true
         description: 'NPM token'
 
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   main:
     if: github.repository_owner == 'the-nexim'
@@ -33,13 +34,14 @@ jobs:
 
     steps:
       - name: 📥 Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: ${{ inputs.node-version }}
           registry-url: ${{ inputs.npm-registry-url }}
+          package-manager-cache: false
 
       - name: 🛠️ Setup Node.js Corepack
         run: corepack enable

.github/workflows/release.yaml

@@ -2,6 +2,10 @@
 
 name: Build & Lint & Test & Release
 
+# Required permission on the caller workflow
+# permissions:
+#   contents: write
+
 on:
   workflow_call:
     inputs:
@@ -11,30 +15,27 @@ on:
         default: 'lts/*'
         type: string
     secrets:
+      RELEASER_ACCOUNT_TOKEN:
+        required: true
+        description: 'GitHub token for the releaser account'
       GPG_KEY_ID:
         required: true
         description: 'GPG key ID'
-      BOT_TOKEN:
-        required: true
-        description: 'Nexim Bot token'
       GPG_PRIVATE_KEY:
         required: true
         description: 'GPG private key'
 
-permissions:
-  contents: write
-
 jobs:
   main:
     name: Build & Lint & Test & Release
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
 
     steps:
       - name: ⤵️ Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
-          token: ${{ secrets.BOT_TOKEN }}
+          token: ${{ secrets.RELEASER_ACCOUNT_TOKEN }}
 
       - name: 🙂‍↔️ Import GPG key
         run: |
@@ -54,9 +55,10 @@ jobs:
           GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
 
       - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: ${{ inputs.node-version }}
+          package-manager-cache: false
 
       - name: 🛠️ Setup Node.js Corepack
         run: corepack enable
@@ -94,5 +96,5 @@ jobs:
       - name: 🤖 Get Release
         run: yarn lerna version --yes
         env:
-          GITHUB_TOKEN: ${{ secrets.BOT_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.RELEASER_ACCOUNT_TOKEN }}
           WIREIT_LOGGER: metrics

.github/workflows/sync-label.yaml

@@ -0,0 +1,24 @@
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+name: Sync labels
+
+# Required permission on the caller workflow
+# permissions:
+#   contents: read
+#   issues: write
+
+on:
+  workflow_call:
+
+jobs:
+  main:
+    name: Sync labels
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+
+    steps:
+      - name: ⤵️ Check out code from GitHub
+        uses: actions/checkout@v5
+
+      - name: 🚀 Run Label Syncer
+        uses: micnncim/action-label-syncer@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}