build: last attempt to publish on Github package

.github/workflows/publish.yml

@@ -10,7 +10,7 @@ jobs:
     steps:
       - uses: actions/checkout@v2
 
-      - uses: actions/setup-node@v1
+      - uses: actions/setup-node@v2
         with:
           node-version: '12.x'
           registry-url: 'https://registry.npmjs.org'
@@ -23,13 +23,13 @@ jobs:
 
       - name: Publish to NPM packages
         # includes a --ignore-scripts command argument to avoid executing npm life cycle scripts during this phase
-        # for security concerns
+        # for security concerns as scripts could steal NODE_AUTH_TOKEN
         run: npm publish --ignore-scripts --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       # Setup .npmrc file to publish to GitHub Packages
-      - uses: actions/setup-node@v1
+      - uses: actions/setup-node@v2
         with:
           registry-url: 'https://npm.pkg.github.com'