ci: Migrate npm publishing to OIDC and consolidate into reusable workflow (#2264)

* ci: add reusable npm publish workflow for OIDC trusted publishing

npm only allows one trusted publisher (workflow filename) per package.
This reusable workflow is called by both release-packages.yml and
nightly-releases.yml so a single filename can be registered on npmjs.com.

Accepts inputs for pre-build commands, publish commands, and optional
tag pushing. Inherits permissions from the caller workflow.

* ci: split release workflow into changesets and publish jobs

Separates version management from publishing so the OIDC token is
obtained right before changeset publish, avoiding token expiration
during the build step. The publish job calls the reusable npm-publish
workflow.

* ci: migrate nightly releases to OIDC via reusable workflow

Replace NPM_TOKEN auth with OIDC trusted publishing by calling the
shared npm-publish workflow. Upgrades Node.js 18 to 22, removes .npmrc
creation step, and adds workflow_dispatch trigger for manual testing.

Adds optional package input to workflow_dispatch for publishing a
single package (e.g., @faustwp/cli) to debug OIDC incrementally.

* Update .github/workflows/release-packages.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* ci: upgrade npm to >=11.5.1 for OIDC trusted publishing

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: josephfusco

.github/workflows/nightly-releases.yml

@@ -12,6 +12,12 @@ name: Nightly Releases
 # * * * * *
 
 on:
+  workflow_dispatch:
+    inputs:
+      package:
+        description: 'Specific package to publish (e.g., @faustwp/cli). Leave empty for all.'
+        required: false
+        default: ''
   schedule:
     # Monday-Friday at 8:35pm UTC / 3:35pm CST
 
@@ -20,35 +26,16 @@ on:
     # middle of the hour, there is less chance of delay.
     - cron: '35 20 * * 1-5'
 
+permissions:
+  contents: read       # For checking out the repo
+  id-token: write      # For npm OIDC authentication
+
 jobs:
   release_nightly_canary:
     if: github.repository_owner == 'wpengine'
     name: Release Nightly Canary
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js 18.x
-        uses: actions/setup-node@v4
-        with:
-          node-version: 18.x
-
-      - name: Install Dependencies
-        run: npm ci
-
-      - name: Create .npmrc
-        run: |
-          cat << EOF > "$HOME/.npmrc"
-            //registry.npmjs.org/:_authToken=$NPM_TOKEN
-          EOF
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      # https://github.com/atlassian/changesets/blob/master/docs/snapshot-releases.md
-      - name: Release to NPM
-        run: |
-          npm run version:nightly
-          npm run release:nightly
+    # https://github.com/atlassian/changesets/blob/master/docs/snapshot-releases.md
+    uses: ./.github/workflows/npm-publish.yml
+    with:
+      pre-build-command: npm run version:nightly
+      publish-command: ${{ inputs.package && format('npm publish -w {0} --tag canary', inputs.package) || 'changeset publish --tag canary' }}

.github/workflows/npm-publish.yml

@@ -0,0 +1,66 @@
+name: Publish to npm
+
+on:
+  workflow_call:
+    inputs:
+      pre-build-command:
+        description: 'Command to run before building (e.g., snapshot versioning)'
+        type: string
+        required: false
+        default: ''
+      publish-command:
+        description: 'Command to run for publishing'
+        type: string
+        required: true
+      push-tags:
+        description: 'Whether to push git tags after publishing'
+        type: boolean
+        required: false
+        default: false
+
+# No permissions block — inherits from caller workflow.
+# Release caller grants contents: write + id-token: write (enables git push and OIDC).
+# Nightly caller grants contents: read + id-token: write (enables checkout and OIDC).
+
+jobs:
+  publish:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js 22.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Upgrade npm for OIDC support
+        run: npm install -g npm@^11.5.1
+
+      - name: Verify OIDC token availability
+        run: |
+          if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL}" ]; then
+            echo "::error::OIDC token not available. Ensure the caller workflow has 'id-token: write' permission."
+            exit 1
+          fi
+          echo "OIDC token endpoint available"
+
+      - name: Pre-build
+        if: inputs.pre-build-command != ''
+        run: ${{ inputs.pre-build-command }}
+
+      - name: Build packages
+        run: npm run build
+
+      - name: Publish to npm
+        run: ${{ inputs.publish-command }}
+
+      - name: Push tags
+        if: inputs.push-tags
+        run: git push --follow-tags

.github/workflows/release-packages.yml

@@ -6,14 +6,16 @@ on:
       - canary
 
 permissions:
-  contents: write      # For creating releases/tags
+  contents: write      # For creating releases/tags and pushing tags
   pull-requests: write # For creating version PRs
   id-token: write      # For npm OIDC authentication
 
 jobs:
-  release_packages:
-    name: Release Packages
+  changesets:
+    name: Manage Changesets
     runs-on: ubuntu-22.04
+    outputs:
+      has-changesets: ${{ steps.changesets.outputs.hasChangesets }}
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
@@ -25,34 +27,23 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 22.x
-          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: npm ci
 
-      - name: Create Release Pull Request or Publish to npm
+      - name: Create Release Pull Request
         id: changesets
         uses: changesets/action@v1
         with:
-          # This expects you to have a script called release which does a build for your packages and calls changeset publish
-          publish: npm run release
           version: npm run version
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Save Plugin version
-        run: |
-          json=${{ toJSON(steps.changesets.outputs.publishedPackages) }}
-          echo PLUGIN_VERSION=$(echo "$json" | jq '.[] | select(.name == "@faustwp/wordpress-plugin") | .version') >> $GITHUB_ENV
-      - name: Deploy WordPress plugin
-        # Checks the changesets publishedPackages output
-        # If there is a published package named "@faustwp/wordpress-plugin"
-        # Then deploy the WordPress plugin
-        # https://github.com/changesets/action#outputs
-        if: steps.changesets.outputs.published && contains(steps.changesets.outputs.publishedPackages, '"@faustwp/wordpress-plugin"')
-        uses: ./.github/actions/release-plugin
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-        env:
-          PLUGIN_DIR: plugins/faustwp
-          SLUG: faustwp
-          VERSION: ${{ env.PLUGIN_VERSION }}
+
+  publish:
+    name: Publish to npm
+    needs: changesets
+    if: needs.changesets.outputs.has-changesets == 'false'
+    uses: ./.github/workflows/npm-publish.yml
+    with:
+      publish-command: npx changeset publish
+      push-tags: true