chore(NODE-7562): use npm trusted publisher for nightly release (#4930)

Author: tadjik1

.github/scripts/dispatch-and-wait.mjs

@@ -0,0 +1,73 @@
+// @ts-check
+// TODO(NODE-7570): replace with workflow_call once GitHub/npm resolve the OIDC
+// workflow_ref mismatch (https://github.com/npm/documentation/issues/1755).
+//
+// Dispatch a workflow_dispatch-triggered GitHub Actions workflow and wait for
+// the resulting run to complete (propagating its exit status).
+//
+// `gh workflow run` prints the created workflow run URL on stdout when the
+// server returns it (current github.com API version does); we parse the run
+// id out of the URL and pass it to `gh run watch`.
+//
+// Usage:
+//   node dispatch-and-wait.mjs <workflow.yml> [key=value ...]
+//
+//   For npm-publish.yml specifically:
+//   node dispatch-and-wait.mjs npm-publish.yml tag=<tag> version=<v> ref=<sha>
+//
+// Arguments:
+//   <workflow.yml>    Filename of the target workflow under .github/workflows/
+//                     in the same repo. Must declare `on: workflow_dispatch:`.
+//   key=value ...     Inputs forwarded to the dispatched workflow. Valid keys
+//                     and which of them are required are determined by the
+//                     target workflow's `on.workflow_dispatch.inputs`; the
+//                     dispatch fails if any required input is missing or any
+//                     unknown input is passed. For `npm-publish.yml`, all of
+//                     `tag`, `version`, and `ref` are required.
+//                     Example: tag=nightly version=1.2.3 ref=abc1234
+//
+// Environment:
+//   GH_TOKEN              (required) used by the gh CLI; in a workflow set
+//                         this to ${{ github.token }}.
+//   DISPATCH_WORKFLOW_REF (optional, default `main`) git ref the target
+//                         workflow file is loaded from. Hardcoded to main by
+//                         default so callers on backport branches don't have
+//                         to keep a copy of the target workflow on their
+//                         branch.
+import * as child_process from 'node:child_process';
+import * as process from 'node:process';
+
+const [, , workflow, ...inputArgs] = process.argv;
+if (!workflow) {
+  console.error('usage: dispatch-and-wait.mjs <workflow.yml> [key=value ...]');
+  process.exit(2);
+}
+
+const dispatchRef = process.env.DISPATCH_WORKFLOW_REF || 'main';
+
+const ghArgs = [
+  'workflow', 'run', workflow,
+  '--ref', dispatchRef,
+  ...inputArgs.flatMap(kv => ['-f', kv])
+];
+console.log(`Dispatching ${workflow} from ref ${dispatchRef}`);
+
+const dispatch = child_process.spawnSync('gh', ghArgs, {
+  encoding: 'utf8',
+  stdio: ['inherit', 'pipe', 'inherit']
+});
+if (dispatch.status !== 0) process.exit(dispatch.status ?? 1);
+
+// gh prints e.g. "https://github.com/owner/repo/actions/runs/<id>"
+const match = dispatch.stdout.match(/\/actions\/runs\/(\d+)/);
+if (!match) {
+  console.error('Could not extract run id from gh workflow run output:', dispatch.stdout);
+  process.exit(1);
+}
+const runId = match[1];
+console.log(`Dispatched run ${runId}`);
+
+const watch = child_process.spawnSync('gh', ['run', 'watch', runId, '--exit-status'], {
+  stdio: 'inherit'
+});
+process.exit(watch.status ?? 1);

.github/workflows/npm-publish.yml

@@ -0,0 +1,40 @@
+# This workflow is invoked by callers via `workflow_dispatch` (the GitHub
+# Actions API), NOT as a reusable workflow (`on: workflow_call:`). With
+# workflow_call, the OIDC token's workflow_ref claim points to the caller's
+# filename rather than this file, which breaks npm Trusted Publishing's
+# workflow-filename matching. See npm/documentation#1755.
+name: npm-publish
+
+run-name: 'npm-publish ${{ inputs.tag }}@${{ inputs.version }}'
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'npm dist-tag (e.g. nightly, latest, alpha)'
+        required: true
+        type: string
+      version:
+        description: 'Package version to publish'
+        required: true
+        type: string
+      ref:
+        description: 'Git ref (commit SHA preferred) to publish from'
+        required: true
+        type: string
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.ref }}
+      - name: Install Node and dependencies
+        uses: mongodb-labs/drivers-github-tools/node/setup@v3
+      - run: npm version "${{ inputs.version }}" --git-tag-version=false --allow-same-version
+      - run: npm publish --provenance --tag="${{ inputs.tag }}"

.github/workflows/release-nightly.yml

@@ -11,7 +11,8 @@ on:
   workflow_dispatch: {}
 
 permissions:
-  id-token: write
+  contents: read
+  actions: write
 
 name: release-nightly
 
@@ -25,6 +26,12 @@ jobs:
       - id: build_nightly
         run: npm run build:nightly
       - if: ${{ steps.build_nightly.outputs.publish == 'yes' }}
-        run: npm publish --provenance --tag=nightly
+        name: Dispatch npm-publish workflow
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+          DISPATCH_WORKFLOW_REF: ${{ github.sha }}
+        run: |
+          node ./.github/scripts/dispatch-and-wait.mjs npm-publish.yml \
+            tag=nightly \
+            version="$(node -p "require('./package.json').version")" \
+            ref="${{ github.sha }}"

etc/notes/releasing.md

@@ -104,6 +104,12 @@ The github action is able to publish with the repository secret `NPM_TOKEN`.
 This is a granular API key that is unique to each package and has to be rotated on a regular basis.
 The `dbx-node@mongodb.com` npm account is the author of the automated release.
 
+The nightly release flow is an exception: `release-nightly.yml` dispatches
+`.github/workflows/npm-publish.yml`, which authenticates to the npm registry
+via [npm Trusted Publishing](https://docs.npmjs.com/trusted-publishers) (OIDC)
+rather than `NPM_TOKEN`. The `mongodb` package's trusted publisher entry on
+npmjs.com points at `npm-publish.yml`.
+
 ### Prebuilds
 
 Our native packages offer pre built binaries using [`prebuild`](https://github.com/prebuild/prebuild).