ci: Enhance NPM publishing security with OIDC

Migrates the npm publish steps in the production and RC release workflows to use OpenID Connect (OIDC) for authentication. This removes the reliance on a long-lived npm token secret, improving security by leveraging short-lived, ephemeral credentials.

Author: al-af

.github/workflows/production-release.yml

@@ -156,6 +156,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [validate-release]
     if: needs.validate-release.result == 'success' && needs.validate-release.outputs.is_valid == 'true'
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Checkout repository
@@ -165,17 +168,15 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Publish to npm
         if: needs.validate-release.outputs.is_dry_run != 'true'
         env:
-          CI_NPM_TOKEN: ${{ secrets.CI_NPM_TOKEN }}
           VERSION: ${{ needs.validate-release.outputs.version }}
         run: |
           echo "Publishing version $VERSION to npm..."
-          echo "//registry.npmjs.org/:_authToken=$CI_NPM_TOKEN" > ~/.npmrc
           npm publish
-          rm ~/.npmrc
           echo "Published $VERSION to npm"
 
       - name: Dry-run publish

.github/workflows/rc-release.yml

@@ -452,6 +452,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [validate-release, prepare-branch, pre-publish-gate, validate-jira]
     if: always() && needs.pre-publish-gate.result == 'success' && needs.pre-publish-gate.outputs.passed == 'true' && (needs.validate-jira.result == 'success' || needs.validate-jira.result == 'skipped')
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
@@ -463,6 +466,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
         run: npm install
@@ -477,15 +481,7 @@ jobs:
 
       - name: Publish RC to npm
         if: ${{ needs.validate-release.outputs.is_dry_run != 'true' }}
-        env:
-          CI_NPM_TOKEN: ${{ secrets.CI_NPM_TOKEN }}
-        run: |
-          if [[ -z "${CI_NPM_TOKEN}" ]]; then
-            echo "CI_NPM_TOKEN is missing"; exit 1
-          fi
-          echo "//registry.npmjs.org/:_authToken=${CI_NPM_TOKEN}" > ~/.npmrc
-          npm publish --tag rc
-          rm -f ~/.npmrc
+        run: npm publish --tag rc
 
   # ===========================================================================
   # Create Pre-Release Tag