TPIP

Bump actions/setup-node from 4.4.0 to 6.0.0 #88

	name: TPIP

	on:
	pull_request:
	paths:
	- '.github/workflows/tpip.yml'
	- docs/third-party-licenses.json
	- docs/tpip-header.md
	- scripts/tpip-reporter.ts
	- '!*/.md'
	- '!.github/workflows/markdown.yml'
	- '!.github/markdownlint.json'
	- '!.github/markdownlint.jsonc'
	branches:
	- main
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	report:
	permissions:
	# contents: write # for Git to git push # disabled until resurrecting direct git push
	packages: read

	name: Generate report
	runs-on: ubuntu-latest
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
	with:
	egress-policy: audit

	- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
	with:
	ref: ${{ github.head_ref }}

	- uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
	env:
	NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	with:
	node-version: '20'
	registry-url: https://npm.pkg.github.com
	always-auth: true
	package-manager-cache: false

	- name: Install dependencies
	run: yarn --frozen-lockfile --prefer-offline

	- name: Generate third-party licenses report
	run: yarn run tpip:report

	- name: Commit changes
	if: false
	run: \|
	git config --local user.email "[email protected]"
	git config --local user.name "GitHub Action"
	git add TPIP.md
	git commit -m "Update third-party licenses report [skip ci]"
	git push

Provide feedback