use NPM "trusted publishers" instead of tokens

[ryepup]

Is your feature request related to a problem? Please describe

The CI pipelines uses a deprecated approach to publishing npm packages, and required manual effort every 90d to update the token.

Describe the solution you'd like

NPM has a better option based on OIDC: https://docs.npmjs.com/trusted-publishers

Describe alternatives you've considered

Runbooks, github issue templates

Additional context

Not many people have access to this repo, so the more automation the better.

[gitcommitshow]

Heads up - use node v24 in your github action for the publishing or it will throw error due to auth issue

Make sure you also have other settings - gitcommitshow/resilient-llm#39 (comment)

[thresheek]

Can we bump this up? We would like to get rid of the long-lived credentials on GH sooner than later. Setting up an OIDC flow is just perfect for that.

[ryepup]

Just got a notice from npm:

As a precaution to help prevent further supply chain attacks following the pattern of "Mini Shai-Hulud" we are rotating npm granular access tokens

Gonna try to do this ticket instead of updating the token again.

[ryepup]

updated npm settings:

[ryepup]

deleted the repo NPM_TOKEN secret from github and all the access tokens from npm (which were all expired).

The workflow needs a little more help, they are a little too intermingled in one file to feel ok messing with permissions, PR coming soon.

[ryepup]

The updated workflows don't work 👎

• the "push a tag" workflow does not trigger the "publish to NPM" workflow because github blocks that to prevent infinite loops: https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow#triggering-a-workflow-from-a-workflow
• the "publish to NPM" workflow doesn't work https://github.com/nginx/nginx-directive-reference/actions/runs/28823922328/job/85482175471

npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@nginx%2freference-lib - Not found
npm error 404
npm error 404  The requested resource '@nginx/reference-lib@1.1.36' could not be found or you do not have permission to access it.
npm error 404
npm error 404 Note that you can also install from a
npm error 404 tarball, folder, http url, or git url.

So something about the OIDC isn't configured right

[ryepup]

OK, had to re-add the OIDC settings on the NPM side, and now it's happy. The workflow are still messed up, but at least the new version is out there.

[ryepup]

I think I just need to combine the git tag and npm publish into the same workflow, so it'll all fire as one. The alternatives seem to require adding a secret (PAT or "deploy key") that would need rotating, or figuring out what "github apps" entails. Neither of those seem worthwhile for what this repo does.

I'll combine the workflows in a few weeks after a vacation.