[FSSDK-12891] Switch npm publishing to OIDC trusted publishing

Replace long-lived NPM_PUBLISH_TOKEN with OIDC trusted publishing
for more secure, tokenless CI publishing to npm.

Workflow changes:
- Add id-token: write permission for OIDC token generation
- Move permissions to workflow level (add packages: write for GHR)
- Add GitHub environment gate (npm) for deployment protection
- Upgrade setup-node to v4 and Node to 22 (npm 11.5.1+ requirement)
- Add npm upgrade step to ensure OIDC support
- Remove NPM_PUBLISH_TOKEN from npm publish step (OIDC replaces it)

publish.sh changes:
- Make NODE_AUTH_TOKEN optional in curl lookup (public packages
  don't need auth for registry reads)
- Add --provenance flag for npm registry publishes (supply-chain
  attestations, not supported by GHR)

GHR publish step is unchanged — still uses GITHUB_TOKEN.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: FarhanAnjum-opti

.github/workflows/release.yml

@@ -5,26 +5,31 @@ on:
     types: [published, edited]
   workflow_dispatch: {}
 
+permissions:
+  id-token: write
+  contents: read
+  packages: write
+
 jobs:
   publish:
     name: Publish to NPM and GitHub Package Registry
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'workflow_dispatch' || !github.event.release.draft }}
-    permissions:
-      contents: read
-      packages: write
+    environment: npm
     steps:
       - name: Checkout branch
         uses: actions/checkout@v4
         with:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: 22
           registry-url: "https://registry.npmjs.org/"
-          always-auth: "true"
+
+      - name: Upgrade npm for OIDC support
+        run: npm install -g npm@latest
 
       # Add auth for the GitHub Package Registry publish. npm expands
       # ${NODE_AUTH_TOKEN} at runtime per-step, so each publish step uses the
@@ -55,10 +60,12 @@ jobs:
       # current latest, otherwise v<major>-last-published; beta/alpha/rc for
       # pre-releases. npm publishes first; if it fails the job stops before GHR,
       # keeping the registries in sync.
+      #
+      # npm publish uses OIDC trusted publishing (no NPM_PUBLISH_TOKEN needed).
+      # publish.sh adds --provenance for supply-chain attestations.
       - id: release
         name: Publish to NPM
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
           TARBALL: ${{ steps.pack.outputs.tarball }}
           DRY_RUN: ${{ github.event_name == 'workflow_dispatch' }}
         run: scripts/publish.sh "https://registry.npmjs.org" "$TARBALL"

scripts/publish.sh

@@ -87,8 +87,12 @@ trap 'rm -f "$body_file"' EXIT
 # curl -sS (no --fail) returns 0 for any HTTP response, non-zero only on
 # network/protocol errors — so we can cleanly separate "server answered" from
 # "could not reach server".
+curl_auth_args=()
+if [[ -n "${NODE_AUTH_TOKEN:-}" ]]; then
+  curl_auth_args=(-H "Authorization: Bearer ${NODE_AUTH_TOKEN}")
+fi
 if ! http_code=$(curl -sS -m 30 -o "$body_file" -w '%{http_code}' \
-      -H "Authorization: Bearer ${NODE_AUTH_TOKEN:-}" "$packument_url"); then
+      "${curl_auth_args[@]}" "$packument_url"); then
   echo "ERROR: request to ${packument_url} failed (network/timeout); refusing to publish on an ambiguous result." >&2
   exit 1
 fi
@@ -134,11 +138,18 @@ if [[ "$dry_run" == "true" ]]; then
   exit 0
 fi
 
+# Add --provenance for npm registry (OIDC trusted publishing generates
+# supply-chain attestations). Not supported by GitHub Package Registry.
+provenance_flag=""
+if [[ "$registry" == *"registry.npmjs.org"* ]]; then
+  provenance_flag="--provenance"
+fi
+
 echo "Publishing ${pkg}@${version} (tag: ${tag}) to ${registry}"
 if [[ -n "$tarball" ]]; then
   # The tarball is a prebuilt artifact; skip lifecycle scripts (prepublishOnly
   # = test + build) that would otherwise run from the current package.json.
-  npm publish "$tarball" --registry "$registry" --tag "$tag" --ignore-scripts
+  npm publish "$tarball" --registry "$registry" --tag "$tag" --ignore-scripts $provenance_flag
 else
-  npm publish --registry "$registry" --tag "$tag"
+  npm publish --registry "$registry" --tag "$tag" $provenance_flag
 fi