New attempt at fixing NPM publishing with trusted publisher (#3810)

Author: SamyPesse

.github/workflows/publish.yaml

@@ -5,11 +5,6 @@ on:
         branches:
             - main
 
-permissions:
-    id-token: write
-    pull-requests: write
-    contents: write
-
 env:
     BUN_NPM_TOKEN: ${{ secrets.NPM_TOKEN_READONLY }}
 
@@ -19,6 +14,10 @@ jobs:
     publish:
         name: Publish
         runs-on: ubuntu-latest
+        permissions:
+            id-token: write
+            pull-requests: write
+            contents: write
         steps:
             - name: Checkout Repo
               uses: actions/checkout@v3
@@ -50,7 +49,3 @@ jobs:
             - name: Publish to NPM
               if: steps.changesets.outputs.hasChangesets == 'false'
               run: bun run publish-all-packages
-              env:
-                  GITHUB_TOKEN: ${{ github.token }}
-                  NODE_AUTH_TOKEN: ${{ env.NODE_AUTH_TOKEN }}
-                  NPM_CONFIG_USERCONFIG: ${{ env.NPM_CONFIG_USERCONFIG }}

scripts/publish-if-new.sh

@@ -8,6 +8,9 @@
 
 set -euo pipefail
 
+echo "Node auth token: ${NODE_AUTH_TOKEN}"
+echo "NPM config userconfig: ${NPM_CONFIG_USERCONFIG}"
+
 NAME=$(node -p "require('./package.json').name")
 VERSION=$(node -p "require('./package.json').version")
 
@@ -37,4 +40,5 @@ fi
 # Clean up the tarball
 trap 'rm -f "${TARBALL_PATH}"' EXIT
 
-npm publish "${TARBALL_PATH}" --no-workspaces --provenance
+# Publish with verbose logging to aid debugging
+npm publish "${TARBALL_PATH}" --no-workspaces --provenance --loglevel=verbose

turbo.json

@@ -57,7 +57,7 @@
         "publish-to-npm": {
             "dependsOn": ["build"],
             "cache": false,
-            "env": ["NODE_AUTH_TOKEN", "NPM_CONFIG_USERCONFIG"]
+            "env": ["NODE_AUTH_TOKEN", "NPM_CONFIG_USERCONFIG", "ACTIONS_ID_TOKEN_*"]
         },
         // Clean up the package
         "clean": {