[ACS-10763] Switch to NPM trusted publishing (#4907)

* [ACS-10763] Switch to NPM trusted publishing

* [ACS-10763] Change contents permission to read

* [ACS-10763] Cover GH packages

* [ACS-10763] Bump Node and NPM versions to match trusted publishing requirements

* [ACS-10763] Add the exit on error step for publishing

* [ACS-10763] Fix package lock, move set -e to the release script

.github/actions/publish-libs/action.yml

@@ -8,9 +8,6 @@ inputs:
   github_token:
     description: 'Github token'
     required: true
-  npm_registry_token:
-    description: 'NPM registry token'
-    required: true
   npm_tag:
     description: 'NPM tag'
     required: true
@@ -59,6 +56,5 @@ runs:
       shell: bash
       run: ${{ github.action_path }}/npm-publish.sh "$TAG" "$DRY_RUN"
       env:
-        NODE_AUTH_TOKEN: ${{ inputs.npm_registry_token }}
         TAG: ${{ inputs.npm_tag }}
         DRY_RUN: ${{ inputs.dry-run }}

.github/actions/publish-libs/npm-publish.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -e
+
 ROOT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )/../../.." && pwd )"
 DIST_DIR="$ROOT_DIR/dist/@alfresco"
 TAG=$1

.github/workflows/release.yml

@@ -39,6 +39,10 @@ on:
       - master
       - develop
 
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
 env:
   BASE_URL: ${{ secrets.PIPELINE_ENV_URL }}
   ADMIN_EMAIL: ${{ secrets.PIPELINE_ADMIN_USERNAME }}
@@ -205,6 +209,8 @@ jobs:
     name: "Publish libs to NPM and GitHub registry"
     runs-on: ubuntu-latest
     permissions:
+      id-token: write  # Required for OIDC
+      contents: read
       packages: write
     steps:
       - name: Check previous jobs status
@@ -230,8 +236,7 @@ jobs:
         uses: ./.github/actions/publish-libs
         with:
           branch_name: ${{ env.BRANCH_NAME }}
-          github_token: ${{ secrets.BOT_GITHUB_TOKEN }}
-          npm_registry_token: ${{ secrets.NPM_REGISTRY_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
           npm_tag: ${{ env.TAG_NPM }}
           dry-run: ${{ inputs.dry-run-release }}