[FSSDK-12891] Switch npm publishing to OIDC trusted publishing

Replace long-lived NPM_PUBLISH_TOKEN with OIDC trusted publishing
for more secure, tokenless CI publishing.

Changes:
- Add id-token: write permission for OIDC token generation
- Upgrade setup-node to v4 and Node to 22 (npm 11.5.1+ requirement)
- Add npm upgrade step to ensure OIDC support
- Remove NPM_PUBLISH_TOKEN references
- Add --provenance flag for supply-chain attestations
- Add GitHub environment gate (npm) for deployment protection
- Separate dry-run and real-publish paths (provenance incompatible with dry-run)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: FarhanAnjum-opti

.github/workflows/release.yml

@@ -5,23 +5,28 @@ on:
     types: [published, edited]
   workflow_dispatch: {}
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   publish:
     name: Publish to NPM
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'workflow_dispatch' || !github.event.release.draft }}
+    environment: npm
     steps:
       - name: Checkout branch
         uses: actions/checkout@v4
 
       - name: Setup Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: 22
           registry-url: "https://registry.npmjs.org/"
-          always-auth: "true"
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
+
+      - name: Upgrade npm for OIDC support
+        run: npm install -g npm@latest
 
       - name: Install dependencies
         run: npm install
@@ -42,7 +47,7 @@ jobs:
         run: |
           VERSION=$(jq -r '.version' package.json)
           LATEST_RELEASE_TAG="${{ steps.latest-release.outputs['latest-release-tag']}}"
-          
+
           if [[ ${{ github.event_name }} == "workflow_dispatch" ]]; then
             RELEASE_TAG=${GITHUB_REF#refs/tags/}
           else
@@ -66,16 +71,9 @@ jobs:
         env:
           BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME }}
           BROWSERSTACK_ACCESS_KEY: ${{ secrets.BROWSERSTACK_ACCESS_KEY }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
         run: |
           if [[ ${{ github.event_name }} == "workflow_dispatch" ]]; then
-            DRY_RUN="--dry-run"
+            npm publish --tag=${{ steps.npm-tag.outputs['npm-tag'] }} --dry-run
+          else
+            npm publish --tag=${{ steps.npm-tag.outputs['npm-tag'] }} --provenance
           fi
-          npm publish --tag=${{ steps.npm-tag.outputs['npm-tag'] }} $DRY_RUN
-
-      # - name: Report results to Jellyfish
-      #   uses: optimizely/jellyfish-deployment-reporter-action@main
-      #   if: ${{ always() && github.event_name == 'release' && (steps.release.outcome == 'success' || steps.release.outcome == 'failure') }}
-      #   with:
-      #     jellyfish_api_token: ${{ secrets.JELLYFISH_API_TOKEN }}
-      #     is_successful: ${{ steps.release.outcome == 'success' }}