GLSP-1594: Switch to trusted publishing

.github/workflows/publish.yml

@@ -0,0 +1,90 @@
+name: 'Publish to NPM'
+
+on:
+  workflow_run:
+    workflows: ['CI']
+    types:
+      - completed
+    branches: [master]
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref (branch, tag, or commit SHA) to checkout and publish'
+        required: true
+        type: string
+      dist-tag:
+        description: 'NPM dist-tag to use for publishing'
+        required: false
+        type: string
+        default: 'next'
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Git ref (branch, tag, or commit SHA) to checkout and publish'
+        required: true
+        type: string
+      dist-tag:
+        description: 'NPM dist-tag to use for publishing'
+        required: false
+        type: choice
+        options:
+          - next
+          - latest
+        default: 'next'
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    name: Build & Publish
+    runs-on: ubuntu-22.04
+    if: github.repository == 'eclipse-glsp/glsp-server-node' && (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || (github.event.workflow_run.conclusion == 'success'))
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ inputs.ref || github.event.inputs.ref || github.event.workflow_run.head_commit.id || github.sha }}
+          # Fetch all history for lerna to determine versions
+          fetch-depth: 0
+
+      - name: Check for changes in "packages" or "examples" directory
+        id: check_changes
+        run: |
+          DIST_TAG="${{ inputs.dist-tag || github.event.inputs.dist-tag || 'next' }}"
+          # For 'next' dist-tag: check for changes when triggered by workflow_run or workflow_call
+          # For 'latest' dist-tag or workflow_dispatch: always publish
+          if [[ "$DIST_TAG" == "next" ]] && [[ "${{ github.event_name }}" != "workflow_dispatch" ]]; then
+            if git diff --name-only HEAD^ HEAD | grep -qE '^(packages|examples)'; then
+              echo "should_publish=true" >> $GITHUB_OUTPUT
+            else
+              echo "should_publish=false" >> $GITHUB_OUTPUT
+            fi
+          else
+            echo "should_publish=true" >> $GITHUB_OUTPUT
+          fi
+
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        if: steps.check_changes.outputs.should_publish == 'true'
+        with:
+          node-version: 20.x
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Build
+        if: steps.check_changes.outputs.should_publish == 'true'
+        run: yarn
+
+      - name: Publish to NPM
+        if: steps.check_changes.outputs.should_publish == 'true'
+        run: |
+          DIST_TAG="${{ inputs.dist-tag || github.event.inputs.dist-tag || 'next' }}"
+          if [[ "$DIST_TAG" == "next" ]]; then
+             yarn publish:next
+          elif [[ "$DIST_TAG" == "latest" ]]; then
+             yarn publish:latest
+          else
+            echo "Unknown dist-tag: $DIST_TAG"
+            exit 1
+          fi
+        env:
+          NPM_CONFIG_PROVENANCE: 'true'

package.json

@@ -21,6 +21,7 @@
     "lint:ci": "yarn lint --output-file eslint_report.json --format json",
     "lint:fix": "yarn lint --fix",
     "prepare": " yarn compile && yarn bundle",
+    "publish:latest": "lerna publish from-package --no-git-reset -y",
     "publish:next": "lerna publish preminor --exact --canary --preid next --dist-tag next --no-git-reset --no-git-tag-version --no-push --ignore-scripts --yes",
     "start": "yarn --cwd examples/workflow-server-bundled start",
     "start:websocket": "yarn --cwd examples/workflow-server-bundled start:websocket",
@@ -36,7 +37,7 @@
     "@eclipse-glsp/dev": "next",
     "@types/node": "20.x",
     "concurrently": "^8.2.2",
-    "lerna": "^7.0.0",
+    "lerna": "^9.0.0",
     "mocha-ctrf-json-reporter": "0.0.9",
     "typescript": "^5.9.2"
   },