refactor: introduce trusted publishing (#3161)

* refactor: introduce trusted publishing

* Remove NPM_TOKEN from publish workflow

Removed NPM_TOKEN from the workflow for security reasons.

* Update .nvmrc

* Update publish-release.yml

* Update package.json

* Update publish-npm.sh

Author: mfranzke

.github/scripts/publish-npm.sh

@@ -51,15 +51,14 @@ do
     echo "🔑 Authenticated with GITHUB"
   elif [[ $REGISTRY == 'NPM' ]]; then
     npm config set @db-ui:registry https://registry.npmjs.org/
-    npm set //registry.npmjs.org/:_authToken "$NPM_TOKEN"
     echo "🔑 Authenticated with NPM"
   else
     echo "Could not authenticate with $REGISTRY"
     exit 1
   fi
   # https://docs.npmjs.com/generating-provenance-statements#example-github-actions-workflow
-  npm publish --tag "$TAG" db-ui-elements"$PACKAGE_ENDING"-"$VALID_SEMVER_VERSION".tgz --provenance
-  npm publish --tag "$TAG" db-ui-ngx-elements"$PACKAGE_ENDING"-"$VALID_SEMVER_VERSION".tgz --provenance
-  npm publish --tag "$TAG" db-ui-react-elements"$PACKAGE_ENDING"-"$VALID_SEMVER_VERSION".tgz --provenance
-  npm publish --tag "$TAG" db-ui-v-elements"$PACKAGE_ENDING"-"$VALID_SEMVER_VERSION".tgz --provenance
+  npm publish --tag "$TAG" db-ui-elements"$PACKAGE_ENDING"-"$VALID_SEMVER_VERSION".tgz
+  npm publish --tag "$TAG" db-ui-ngx-elements"$PACKAGE_ENDING"-"$VALID_SEMVER_VERSION".tgz
+  npm publish --tag "$TAG" db-ui-react-elements"$PACKAGE_ENDING"-"$VALID_SEMVER_VERSION".tgz
+  npm publish --tag "$TAG" db-ui-v-elements"$PACKAGE_ENDING"-"$VALID_SEMVER_VERSION".tgz
 done

.github/workflows/03-publish-packages.yml

@@ -80,7 +80,6 @@ jobs:
           VALID_SEMVER_VERSION: ${{ inputs.version }}
           DBUI_THEME: ${{ matrix.themes }}
           PACKAGE_ENDING: ${{ steps.getPkgTheme.outputs.pkgTheme }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           GPR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: ⬆ Upload Package Artifact elements-${{ matrix.themes }}

.github/workflows/publish-release.yml

@@ -53,6 +53,8 @@ jobs:
     uses: ./.github/workflows/03-publish-packages.yml
     needs: [cypress, get-publish-version]
     secrets: inherit
+    permissions:
+      id-token: write  # Required for OIDC
     with:
       release: ${{ needs.get-publish-version.outputs.release }}
       preRelease: ${{ needs.get-publish-version.outputs.preRelease }}

.nvmrc

@@ -1 +1 @@
-22
+24

package.json

@@ -74,7 +74,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "homepage": "https://db-ui.github.io/elements/",
-  "packageManager": "npm@10.9.2",
+  "packageManager": "npm@11.6.1",
   "optionalDependencies": {
     "sass-embedded-linux-x64": "1.93.3"
   }