Update release workflows to support npm trusted publshing (#2669)

Author: nex3

.github/util/initialize/action.yml

@@ -5,6 +5,7 @@ inputs:
   node-version: {required: false, default: 'lts/*'}
   dart-sdk: {required: false, default: stable}
   architecture: {required: false}
+  for-npm-deploy: {required: false, default: false}
 runs:
   using: composite
   steps:
@@ -14,9 +15,22 @@ runs:
         architecture: "${{ inputs.architecture }}"
 
     - uses: actions/setup-node@v6
+      if: "inputs.for-npm-deploy != true"
       with:
         node-version: "${{ inputs.node-version }}"
 
+    - uses: actions/setup-node@v6
+      if: inputs.for-npm-deploy == true
+      with:
+        node-version: "${{ inputs.node-version }}"
+        check-latest: true
+        registry-url: 'https://registry.npmjs.org'
+
+    # npm trusted publisher infrastructure requires npm >=11.5.1
+    - run: npm install -g npm@latest
+      if: inputs.for-npm-deploy == true
+      shell: ${{ runner.os == 'Windows' && 'powershell' || 'bash' }}
+
     # See: https://github.com/dart-lang/sdk/issues/52266
     - run: Invoke-WebRequest https://pub.dev
       if: runner.os == 'Windows'

.github/workflows/release.yml

@@ -65,13 +65,14 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - uses: ./.github/util/initialize
-        with: {github-token: "${{ github.token }}"}
+        with:
+          github-token: ${{ github.token }}
+          for-npm-deploy: true
 
       - name: Deploy
         run: dart run grinder pkg-npm-deploy
         env:
           UPDATE_SASS_SASS_REPO: false
-          NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"
 
   deploy_pub:
     name: Deploy Pub
@@ -113,6 +114,10 @@ jobs:
           node-version: 'lts/*'
           check-latest: true
           registry-url: 'https://registry.npmjs.org'
+
+      # npm trusted publisher infrastructure requires npm >=11.5.1
+      - run: npm install -g npm@latest
+
       - name: Get Dart Sass version
         id: dart-sass-version
         run: echo "version=${{ github.ref_name }}" | tee --append "$GITHUB_OUTPUT"
@@ -127,8 +132,6 @@ jobs:
         run: npm pkg set version='${{ steps.dart-sass-version.outputs.version }}'
         working-directory: pkg/sass-types/
       - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
         working-directory: pkg/sass-types/
 
   deploy_sass_parser:
@@ -147,8 +150,8 @@ jobs:
           check-latest: true
           registry-url: 'https://registry.npmjs.org'
 
-        # The repo package has a file dependency, but the released version needs
-        # a real dependency on the released version of Sass.
+      # The repo package has a file dependency, but the released version needs a
+      # real dependency on the released version of Sass.
       - name: Get Dart Sass version
         id: dart-sass-version
         run: echo "version=${{ github.ref_name }}" | tee --append "$GITHUB_OUTPUT"
@@ -158,8 +161,6 @@ jobs:
       - run: npm run compile
         working-directory: pkg/sass-parser/
       - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
         working-directory: pkg/sass-parser/
 
       - name: Get Sass parser version