ci: Publish to npm registry alongside GH packages registry

[frankieyan]

Some of our repositories are set up to pull from the npm registry when installing @doist-scoped packages, so we can't rely on the GH packages registry alone. Publishing to both will ensure projects set up with either registries can make use of this tool.

References

Closes #18

Test plan

• We'll have to see if the publish script works 🤞

[doistbot-app]

The logic for publishing to the npm registry alongside GitHub Packages is sound, and the addition of id-token: write permissions correctly enables provenance generation. However, there is a blocking issue regarding the version of the setup-node action.

[rfgamaral]

This should no longer be used, publishing to npm must go through Trusted Publishing. However, I'm not exactly sure how to configure that when the package does not yet exist on npm. Maybe it's possible to add a package without publishing first?

Suggested change

	env:
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

[frankieyan]

Good catch @rfgamaral! I don't have the answer to that right now. I logged in as Doistbot into npmjs.com but don't see a way to add a package. I'll do some research and find out.

[frankieyan]

From what I can tell, trusted publishing is set up on the package level, not organization, so I think what we'll need to do is to temporarily add an NPM_TOKEN to the repo secrets here, publish it, then set up the trusted publisher. However: https://github.blog/changelog/2023-07-25-publishing-with-npm-provenance-from-private-source-repositories-is-no-longer-supported/

[rfgamaral]

@frankieyan That doesn't make a lot of sense to me. Tokens are meant to be fully deprecated, and when that happens, you won't be able to add a temporary NPM_TOKEN, so there must be another way.

Also, provenance and trusted publishing are not the same thing. You'll need to remove the --provenance, otherwise the build will likely fail.

[rfgamaral]

If npm fully disables token-based publishing (including granular tokens) for automation, then CI/CD publishing would have to use OIDC Trusted Publishing, and “human / local” publishing would rely on interactive login sessions (not reusable tokens), with 2FA enforced for publishing. ([The GitHub Blog]1)

The bootstrap problem (first publish) and the practical answer today

Today, npm’s own flow has a hard limitation:

• You cannot publish the initial version of a package using OIDC, because you can only configure a Trusted Publisher from the package’s settings page, and that page only exists after the package exists. ([npm Docs]2)
• This is explicitly called out as a limitation in npm/cli tracking (initial publish must be “manual or using a token”). ([GitHub]3)

So if token-based publishing gets fully deprecated, the way to publish a brand-new package becomes:

1. Publish the first version “manually” using session-based auth

   • npm login (which now issues a short-lived session rather than a classic long-lived token) ([The GitHub Blog]1)
   • npm publish from your machine to create the package on npm

2. Immediately configure Trusted Publishing in npmjs.com package settings

   • Add your GitHub Actions / GitLab CI trusted publisher

3. All subsequent releases happen from CI via OIDC

   • No publish tokens in CI

This resolves the chicken-and-egg problem without relying on publishing tokens, because the first publish uses interactive session-based auth, not a CI token. ([The GitHub Blog]1)

What would need to change for “OIDC-first publish” to be possible

npm would need to add something like pre-configuration / reservation of a package name with an OIDC trust policy (similar to what the issue references other registries doing). That capability is being requested, but it’s not the current behavior. ([GitHub]3)

I got this from ChatGPT, so I guess we can do what you suggested, or use the npm login/publish approach for the first release, and then configure trusted publishing. Either way should work.

[frankieyan]

Okay, the package now exists on https://www.npmjs.com/package/@doist/react-compiler-tracker. Let's give this a go

[doistbot-app]

The PR enables publishing to the npm registry, but it currently references a non-existent major version of the setup-node action and is missing the required authentication token for the npm publish step. These issues will cause the workflow to fail.

[rfgamaral]

✅🎉