chore(NODE-7563): migrate 6.x release workflows to npm trusted publishers

.github/scripts/dispatch-and-wait.mjs

@@ -0,0 +1,73 @@
+// @ts-check
+// TODO(NODE-7570): replace with workflow_call once GitHub/npm resolve the OIDC
+// workflow_ref mismatch (https://github.com/npm/documentation/issues/1755).
+//
+// Dispatch a workflow_dispatch-triggered GitHub Actions workflow and wait for
+// the resulting run to complete (propagating its exit status).
+//
+// `gh workflow run` prints the created workflow run URL on stdout when the
+// server returns it (current github.com API version does); we parse the run
+// id out of the URL and pass it to `gh run watch`.
+//
+// Usage:
+//   node dispatch-and-wait.mjs <workflow.yml> [key=value ...]
+//
+//   For npm-publish.yml specifically:
+//   node dispatch-and-wait.mjs npm-publish.yml tag=<tag> version=<v> ref=<sha>
+//
+// Arguments:
+//   <workflow.yml>    Filename of the target workflow under .github/workflows/
+//                     in the same repo. Must declare `on: workflow_dispatch:`.
+//   key=value ...     Inputs forwarded to the dispatched workflow. Valid keys
+//                     and which of them are required are determined by the
+//                     target workflow's `on.workflow_dispatch.inputs`; the
+//                     dispatch fails if any required input is missing or any
+//                     unknown input is passed. For `npm-publish.yml`, all of
+//                     `tag`, `version`, and `ref` are required.
+//                     Example: tag=nightly version=1.2.3 ref=abc1234
+//
+// Environment:
+//   GH_TOKEN              (required) used by the gh CLI; in a workflow set
+//                         this to ${{ github.token }}.
+//   DISPATCH_WORKFLOW_REF (optional, default `main`) git ref the target
+//                         workflow file is loaded from. Hardcoded to main by
+//                         default so callers on backport branches don't have
+//                         to keep a copy of the target workflow on their
+//                         branch.
+import * as child_process from 'node:child_process';
+import * as process from 'node:process';
+
+const [, , workflow, ...inputArgs] = process.argv;
+if (!workflow) {
+  console.error('usage: dispatch-and-wait.mjs <workflow.yml> [key=value ...]');
+  process.exit(2);
+}
+
+const dispatchRef = process.env.DISPATCH_WORKFLOW_REF || 'main';
+
+const ghArgs = [
+  'workflow', 'run', workflow,
+  '--ref', dispatchRef,
+  ...inputArgs.flatMap(kv => ['-f', kv])
+];
+console.log(`Dispatching ${workflow} from ref ${dispatchRef}`);
+
+const dispatch = child_process.spawnSync('gh', ghArgs, {
+  encoding: 'utf8',
+  stdio: ['inherit', 'pipe', 'inherit']
+});
+if (dispatch.status !== 0) process.exit(dispatch.status ?? 1);
+
+// gh prints e.g. "https://github.com/owner/repo/actions/runs/<id>"
+const match = dispatch.stdout.match(/\/actions\/runs\/(\d+)/);
+if (!match) {
+  console.error('Could not extract run id from gh workflow run output:', dispatch.stdout);
+  process.exit(1);
+}
+const runId = match[1];
+console.log(`Dispatched run ${runId}`);
+
+const watch = child_process.spawnSync('gh', ['run', 'watch', runId, '--exit-status'], {
+  stdio: 'inherit'
+});
+process.exit(watch.status ?? 1);

.github/workflows/release-6.x.yml

@@ -6,7 +6,6 @@ on:
 permissions:
   contents: write
   pull-requests: write
-  id-token: write
 
 name: release-6.x
 
@@ -91,15 +90,20 @@ jobs:
 
   publish:
     needs: [release_please, ssdlc, build]
+    permissions:
+      actions: write
+      contents: read
     environment: release
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
 
-      - name: Install Node and dependencies
-        uses: mongodb-labs/drivers-github-tools/node/setup@v2
-
-      - run: npm publish --provenance --tag=6x
+      - name: Dispatch npm-publish workflow
         if: ${{ needs.release_please.outputs.release_created }}
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          node ./.github/scripts/dispatch-and-wait.mjs npm-publish.yml \
+            tag=6x \
+            version="$(node -p "require('./package.json').version")" \
+            ref="${{ github.sha }}"

.github/workflows/release-alpha.yml

@@ -9,7 +9,8 @@ on:
         type: string
 
 permissions:
-  id-token: write
+  actions: write
+  contents: read
 
 name: release-alpha
 
@@ -18,17 +19,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - shell: bash
+        env:
+          ALPHA_VERSION: ${{ inputs.alphaVersion }}
         run: |
           ALPHA_SEMVER_REGEXP="-alpha(\.([0-9]|[1-9][0-9]+))?$"
 
-          if ! [[ "${{ inputs.alphaVersion }}" =~ $ALPHA_SEMVER_REGEXP ]]; then
+          if ! [[ "$ALPHA_VERSION" =~ $ALPHA_SEMVER_REGEXP ]]; then
             echo "Invalid alphaVersion string"
             exit 1
           fi
       - uses: actions/checkout@v5
-      - name: Install Node and dependencies
-        uses: mongodb-labs/drivers-github-tools/node/setup@v2
-      - run: npm version "${{ inputs.alphaVersion }}" --git-tag-version=false
-      - run: npm publish --provenance --tag=alpha
+      - name: Dispatch npm-publish workflow
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+          ALPHA_VERSION: ${{ inputs.alphaVersion }}
+        run: |
+          node ./.github/scripts/dispatch-and-wait.mjs npm-publish.yml \
+            tag=alpha \
+            version="$ALPHA_VERSION" \
+            ref="${{ github.sha }}"

.github/workflows/release-nightly.yml

@@ -11,7 +11,8 @@ on:
   workflow_dispatch: {}
 
 permissions:
-  id-token: write
+  actions: write
+  contents: read
 
 name: release-nightly
 
@@ -25,6 +26,11 @@ jobs:
       - id: build_nightly
         run: npm run build:nightly
       - if: ${{ steps.build_nightly.outputs.publish == 'yes' }}
-        run: npm publish --provenance --tag=nightly
+        name: Dispatch npm-publish workflow
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          node ./.github/scripts/dispatch-and-wait.mjs npm-publish.yml \
+            tag=nightly \
+            version="$(node -p "require('./package.json').version")" \
+            ref="${{ github.sha }}"