From cbb3268d3daf01e236a67f26ef4b5241432a6631 Mon Sep 17 00:00:00 2001
From: Huseyin Kir <73784267+hkir-dev@users.noreply.github.com>
Date: Tue, 4 Aug 2026 12:30:18 +0100
Subject: [PATCH 1/4] version update

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f9bfae1..3800090 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@openactive/data-model-validator",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "description": "A library to allow a developer to validate a JSON document against the OpenActive Modelling Opportunity Specification",
   "homepage": "https://openactive.io",
   "author": "OpenActive Community <hello@openactive.io>",

From f991015632db82d171bf3c6e134d98c5bf1efb94 Mon Sep 17 00:00:00 2001
From: Huseyin Kir <73784267+hkir-dev@users.noreply.github.com>
Date: Tue, 4 Aug 2026 13:45:32 +0100
Subject: [PATCH 2/4] Trusted publisher setup

---
 .github/workflows/publish-to-npm.yaml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish-to-npm.yaml b/.github/workflows/publish-to-npm.yaml
index c17d628..79b2b20 100644
--- a/.github/workflows/publish-to-npm.yaml
+++ b/.github/workflows/publish-to-npm.yaml
@@ -4,6 +4,10 @@ on:
   push:
     branches: [ master ]
 
+permissions:
+  contents: write
+  id-token: write   # Trusted publishing enabled
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -17,7 +21,7 @@ jobs:
         app-id: ${{ secrets.GH_APP_ID }}
         private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
       with:
         token: ${{ steps.generate-token.outputs.token }}
     - name: Identify
@@ -25,7 +29,7 @@ jobs:
         git config --global user.name "openactive[bot]"
         git config --global user.email 207210293+openactive[bot]@users.noreply.github.com
     - name: Use Node.js 18.17.1
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@v4
       with:
         node-version: 18.17.1
         registry-url: https://registry.npmjs.org/
@@ -36,9 +40,7 @@ jobs:
     - name: Increment Version
       run: npm version patch
     - name: Publish to npm
-      run: npm publish
-      env:
-        NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+      run: npm publish --provenance
     - name: Push version update
       run: git push
 

From 127c9bebfbc0d8c58d78129e5afa21836c5848fb Mon Sep 17 00:00:00 2001
From: Huseyin Kir <73784267+hkir-dev@users.noreply.github.com>
Date: Wed, 5 Aug 2026 11:35:42 +0100
Subject: [PATCH 3/4] new nmp token generated

---
 .github/workflows/publish-to-npm.yaml | 6 ++++--
 package.json                          | 4 ++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-to-npm.yaml b/.github/workflows/publish-to-npm.yaml
index 79b2b20..8efd01c 100644
--- a/.github/workflows/publish-to-npm.yaml
+++ b/.github/workflows/publish-to-npm.yaml
@@ -6,7 +6,7 @@ on:
 
 permissions:
   contents: write
-  id-token: write   # Trusted publishing enabled
+  # id-token: write   # Trusted publishing enabled
 
 jobs:
   publish:
@@ -40,7 +40,9 @@ jobs:
     - name: Increment Version
       run: npm version patch
     - name: Publish to npm
-      run: npm publish --provenance
+      run: npm publish
+      env:
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN2 }}
     - name: Push version update
       run: git push
 
diff --git a/package.json b/package.json
index 3800090..44e130c 100644
--- a/package.json
+++ b/package.json
@@ -59,5 +59,9 @@
     "test-debug": "node --inspect-brk -i ./node_modules/jasmine/bin/jasmine.js",
     "postpublish": "git push",
     "publish-patch": "npm test && git pull && git push && npm version patch && npm publish"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
   }
 }

From 3d27ea1522551969dce434d186952d6cf3ef3f90 Mon Sep 17 00:00:00 2001
From: Huseyin Kir <73784267+hkir-dev@users.noreply.github.com>
Date: Wed, 5 Aug 2026 11:45:28 +0100
Subject: [PATCH 4/4] rollback trusted publisher based approach

---
 package.json | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/package.json b/package.json
index 44e130c..3800090 100644
--- a/package.json
+++ b/package.json
@@ -59,9 +59,5 @@
     "test-debug": "node --inspect-brk -i ./node_modules/jasmine/bin/jasmine.js",
     "postpublish": "git push",
     "publish-patch": "npm test && git pull && git push && npm version patch && npm publish"
-  },
-  "publishConfig": {
-    "access": "public",
-    "provenance": true
   }
 }