Merge pull request #578 from code0-tech/577-setup-trusted-publishing

Setup trusted publishing for graphql types npm package

Author: Taucher2003

.github/workflows/ci.yml

@@ -29,7 +29,6 @@ jobs:
           GLPA_C0_GH_REF: ${{ github.ref }}
           GLPA_C0_GH_REF_NAME: ${{ github.ref_name }}
           GLPA_C0_GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GLPA_C0_NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
 
       - name: Find existing comment
         uses: peter-evans/find-comment@v3

.gitlab-ci.yml

@@ -142,12 +142,15 @@ npm-types:generate-graphql:
 
 
 .npm-types:publish-graphql:
-  image: node:22.18.0
+  image: node:24.8.0
   needs:
     - npm-types:generate-graphql
   variables:
-    NODE_AUTH_TOKEN: $C0_NODE_AUTH_TOKEN
     GIT_STRATEGY: empty
+    NPM_CONFIG_PROVENANCE: "false"
+  id_tokens:
+    NPM_ID_TOKEN:
+      aud: "npm:registry.npmjs.org"
   script:
     - cd tooling/graphql/types
     - npm ci
@@ -161,7 +164,7 @@ npm-types:publish-graphql-dry-run:
   stage: test
   script:
     - !reference [.npm-types:publish-graphql, script]
-    - npm publish --dry-run
+    - npm publish --dry-run --tag latest
   artifacts:
     expire_in: 7 days
     paths:
@@ -175,7 +178,7 @@ npm-types:publish-graphql:
   stage: publish
   script:
     - !reference [ .npm-types:publish-graphql, script ]
-    - npm publish
+    - npm publish --tag latest
   rules:
     - if: $C0_GH_REF_NAME == "main"
       when: manual