chore: switch to Trusted Publishing (#389)

Signed-off-by: Mykhailo Kuznietsov <mkuznets@redhat.com>

Author: mkuznyetsov

.github/workflows/devworkspace-generator-publish-next.yml

@@ -0,0 +1,135 @@
+#
+# Copyright (c) 2022-2024
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+
+# Main workflow for building and publishing release builds
+# Release commit 
+name: Publish project to npmjs
+
+on:
+  workflow_dispatch:
+    inputs:
+      release-version:
+        description: 'release version in format 7.y.z'
+        required: true
+      release-remake:
+        description: 'set to true to recreate existing tags (otherwise release will fail if tags already exist)'
+        type: boolean
+        default: false
+        required: true
+  push:
+    branches:
+      - main
+      - 7.**.x
+
+permissions:
+  id-token: write  # Required for publishing to npmjs
+  contents: write
+  pull-requests: write
+
+jobs:
+  publish:
+    name: Build and publish DevWorkspace Generator to npmjs
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Validate parameters and build type
+        shell: bash
+        id: dist-tag-eval
+        run: |
+          # check if workflow is triggered manually (release) or via branch push (next build)
+          # release will always be performed as workflow_dispatch trigger, while push triggers are for dev/next builds
+          # based on this information, we determine the dist-tag for pushing to npmjs
+          DIST_TAG=
+          if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
+            RELEASE_VERSION=${{ github.event.inputs.release-version }}
+            if [[ "$RELEASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              echo "[INFO]" preparing to build and release with version: $RELEASE_VERSION
+              # DIST_TAG is not used in make-release.sh, as release version will always be latest anyway
+              DIST_TAG=latest
+            else
+              echo "[ERROR] incorrect version "$RELEASE_VERSION". Must be following format <number>.<number>.<number>, e.g. 7.111.0"
+              exit 1
+            fi
+          fi
+          if [[ "$GITHUB_EVENT_NAME" == "push" ]]; then
+            if [[ ${GITHUB_REF##*/} == "7."**".x" ]]; then
+              echo "[INFO] using ${GITHUB_REF##*/} tag"
+              DIST_TAG="next-${GITHUB_REF##*/}"
+            else
+              echo "[INFO] using "next" tag"
+              DIST_TAG=next
+            fi
+          fi
+          echo "npm_dist_tag=$DIST_TAG" >> $GITHUB_OUTPUT
+      - name: "Checkout source code"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Check existing release tags
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GITHUB_TOKEN: ${{secrets.DEVWORKSPACE_GENERATOR_RELEASE_GITHUB_TOKEN}}
+        run: |
+          set +e
+          RECREATE_TAGS=${{ github.event.inputs.release-remake }}
+          VERSION=${{ github.event.inputs.release-version }}
+          EXISTING_TAG=$(git ls-remote --exit-code origin refs/tags/${VERSION})
+          if [[ -n ${EXISTING_TAG} ]]; then
+            if [[ ${RECREATE_TAGS} == "true" ]]; then
+              echo "[INFO] Removing tag for ${VERSION} version. New tag will be recreated during release."
+              git push origin :${VERSION}
+            else
+              echo "[ERROR] Cannot proceed with release - tag ${EXISTING_TAG} already exists."
+              exit 1
+            fi
+          else
+            echo "[INFO] No existing tags detected for ${VERSION}"
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+          scope: '@eclipse-che'
+      - name: Set up environment
+        run: |
+          sudo apt-get update -y || true
+          sudo apt-get -y -q install hub
+          hub --version
+      - name: Get yarn cache directory path
+        id: yarn-cache-dir-path
+        run: |
+          echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
+      - uses: actions/cache@v4
+        id: yarn-cache
+        with:
+          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+          key: yarn-${{ hashFiles('yarn.lock') }}
+          restore-keys: yarn-     
+      - name: Build and publish release version
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GITHUB_TOKEN: ${{secrets.DEVWORKSPACE_GENERATOR_RELEASE_GITHUB_TOKEN}}
+        run: |
+          git config --global user.name "Mykhailo Kuznietsov"
+          git config --global user.email "mkuznets@redhat.com"
+
+          ./make-release.sh --version ${{ github.event.inputs.release-version }}
+      - name: Build and publish next version
+        if: github.event_name == 'push'
+        run: |
+          SHORT_SHA1=$(git rev-parse --short=7 HEAD)
+          CURRENT_VERSION=$(jq -r '.version' package.json)
+          NEW_VERSION="${CURRENT_VERSION}-${SHORT_SHA1}"
+          echo New version is ${NEW_VERSION}
+          sed -i -r -e "s/(\"version\": )(\".*\")/\1\"$NEW_VERSION\"/" package.json
+
+          # build
+          yarn
+          yarn compile
+
+          npm publish --tag ${{ steps.dist-tag-eval.outputs.npm_dist_tag }}