feat: add npm OIDC Trusted Publisher support

.github/CODEOWNERS

@@ -0,0 +1,10 @@
+# GitHub CODEOWNERS
+# This file defines code ownership for automatic review requests
+
+# Critical workflow files must be reviewed by repository owner
+/.github/workflows/release.yml @azu
+/.github/workflows/create-release-pr.yml @azu
+/.github/workflows/check-provenance.yml @azu
+
+# CODEOWNERS file itself requires review to prevent bypassing protections
+/.github/CODEOWNERS @azu

.github/workflows/check-provenance.yml

@@ -0,0 +1,221 @@
+name: Check NPM Provenance
+
+on:
+  pull_request:
+    paths:
+      - '**/package.json'
+      - '.github/workflows/check-provenance.yml'
+  push:
+    branches:
+      - master
+    paths:
+      - '**/package.json'
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  check-provenance:
+    name: Check Package Provenance
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      has_missing: ${{ steps.check.outputs.has_missing }}
+      has_unpublished: ${{ steps.check.outputs.has_unpublished }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: lts/*
+
+      - name: Check npm provenance
+        id: check
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const fs = require('node:fs');
+            const path = require('node:path');
+
+            // Get workspace packages from lerna.json
+            function getWorkspacePackages() {
+              const lernaJson = JSON.parse(fs.readFileSync('lerna.json', 'utf-8'));
+              const packagePatterns = lernaJson.packages || ['packages/*'];
+              const packages = [];
+
+              for (const pattern of packagePatterns) {
+                const basePath = pattern.replace('/*', '');
+                if (!fs.existsSync(basePath)) continue;
+
+                const dirs = fs.readdirSync(basePath);
+                for (const dir of dirs) {
+                  const packagePath = path.join(basePath, dir, 'package.json');
+                  if (fs.existsSync(packagePath)) {
+                    const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf-8'));
+                    if (!packageJson.private) {
+                      packages.push({
+                        name: packageJson.name,
+                        version: packageJson.version,
+                        private: packageJson.private || false
+                      });
+                    }
+                  }
+                }
+              }
+              return packages;
+            }
+
+            // Check package status (published + provenance) in a single fetch
+            async function checkPackageStatus(packageName) {
+              try {
+                const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`);
+                if (!response.ok) {
+                  return { published: false, hasProvenance: false };
+                }
+                const data = await response.json();
+
+                // Get latest version
+                const latestVersion = data['dist-tags']?.latest;
+                if (!latestVersion) {
+                  return { published: true, hasProvenance: false };
+                }
+
+                // Check if the latest version has attestations
+                const versionData = data.versions?.[latestVersion];
+                const hasProvenance = !!(versionData?.dist?.attestations);
+
+                return { published: true, hasProvenance };
+              } catch (error) {
+                console.error(`Error checking status for ${packageName}:`, error);
+                return { published: false, hasProvenance: false };
+              }
+            }
+
+            console.log('Checking npm provenance for public packages...\n');
+
+            // Get all public packages from workspace
+            const publicPackages = getWorkspacePackages();
+
+            const results = {
+              withProvenance: [],
+              withoutProvenance: [],
+              notPublished: []
+            };
+
+            for (const pkg of publicPackages) {
+              const status = await checkPackageStatus(pkg.name);
+
+              if (!status.published) {
+                results.notPublished.push(pkg.name);
+                console.log(`SKIP ${pkg.name}: Not published yet`);
+              } else if (status.hasProvenance) {
+                results.withProvenance.push(pkg.name);
+                console.log(`OK ${pkg.name}: Has provenance`);
+              } else {
+                results.withoutProvenance.push(pkg.name);
+                console.log(`MISSING ${pkg.name}: Missing provenance`);
+              }
+            }
+
+            // Summary
+            console.log('\nSummary:');
+            console.log(`  Total public packages: ${publicPackages.length}`);
+            console.log(`  With provenance: ${results.withProvenance.length}`);
+            console.log(`  Without provenance: ${results.withoutProvenance.length}`);
+            console.log(`  Not published: ${results.notPublished.length}`);
+
+            // Save results for next steps
+            fs.writeFileSync('provenance-results.json', JSON.stringify(results, null, 2));
+
+            // Set outputs
+            core.setOutput('has_missing', results.withoutProvenance.length > 0);
+            core.setOutput('has_unpublished', results.notPublished.length > 0);
+            core.setOutput('missing_packages', results.withoutProvenance);
+            core.setOutput('unpublished_packages', results.notPublished);
+
+      - name: Upload results
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: provenance-results
+          path: provenance-results.json
+          retention-days: 1
+
+  post-comment:
+    name: Post PR Comment
+    runs-on: ubuntu-latest
+    needs: check-provenance
+    if: (needs.check-provenance.outputs.has_missing == 'true' || needs.check-provenance.outputs.has_unpublished == 'true') && github.event_name == 'pull_request'
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Download results
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: provenance-results
+
+      - name: Comment on PR
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('node:fs');
+            const results = JSON.parse(fs.readFileSync('provenance-results.json', 'utf8'));
+
+            let comment = '## NPM Package Status\n\n';
+
+            if (results.notPublished.length > 0) {
+              comment += '### New Packages (Not Published Yet)\n\n';
+              comment += 'Run the following commands to set up OIDC and publish:\n\n';
+              results.notPublished.forEach(pkg => {
+                comment += `- [ ] \`npx setup-npm-trusted-publish ${pkg}\`\n`;
+              });
+              comment += '\n';
+            }
+
+            if (results.withoutProvenance.length > 0) {
+              comment += '### Published Packages Missing OIDC Configuration\n\n';
+              comment += 'Configure OIDC for these packages:\n\n';
+              results.withoutProvenance.forEach(pkg => {
+                comment += `- [ ] [${pkg}](https://www.npmjs.com/package/${pkg}/access)\n`;
+              });
+              comment += '\n**Setup Instructions:**\n';
+              comment += '1. Click each package link above\n';
+              comment += '2. Click "Add trusted publisher"\n';
+              comment += '3. Configure with:\n';
+              comment += `   - Repository: \`${context.repo.owner}/${context.repo.repo}\`\n`;
+              comment += '   - Workflow: `.github/workflows/release.yml`\n';
+              comment += '   - Environment: npm\n';
+            }
+
+            // Find existing comment
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+
+            const botComment = comments.find(comment =>
+              comment.user.type === 'Bot' &&
+              comment.body.includes('NPM Package Status')
+            );
+
+            if (botComment) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+                body: comment
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body: comment
+              });
+            }

.github/workflows/create-release-pr.yml

@@ -0,0 +1,87 @@
+name: Create Release PR
+on:
+  workflow_dispatch:
+    inputs:
+      semver:
+        description: 'New Version(semver)'
+        required: true
+        default: 'patch'
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  create-release-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "lts/*"
+          cache: 'yarn'
+
+      - name: Install
+        run: yarn install
+
+      - name: Update Version
+        run: |
+          git config --global user.email "${GIT_AUTHOR_EMAIL}"
+          git config --global user.name "${GIT_AUTHOR_NAME}"
+          yarn run ci:versionup:${SEMVER}
+        env:
+          SEMVER: ${{ github.event.inputs.semver }}
+          GIT_AUTHOR_NAME: ${{ github.actor }}
+          GIT_AUTHOR_EMAIL: ${{ github.actor }}@users.noreply.github.com
+
+      - name: Set PACKAGE_VERSION
+        run: echo "PACKAGE_VERSION=$(cat lerna.json | jq -r .version)" >> $GITHUB_ENV
+
+      - name: Set GitHub Release Note
+        id: release_note
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const result = await exec.getExecOutput(`gh api "/repos/{owner}/{repo}/releases/generate-notes" -f tag_name="v${process.env.PACKAGE_VERSION}" --jq .body`, [], {
+              ignoreReturnCode: true,
+            })
+            core.setOutput('stdout', result.stdout)
+        env:
+          PACKAGE_VERSION: ${{ env.PACKAGE_VERSION }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create Pull Request
+        id: cpr
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "chore(release): v${{ env.PACKAGE_VERSION }}"
+          committer: GitHub <noreply@github.com>
+          author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
+          assignees: ${{ github.actor }}
+          signoff: false
+          branch: release/${{ env.PACKAGE_VERSION }}
+          branch-suffix: timestamp
+          delete-branch: true
+          title: 'v${{ env.PACKAGE_VERSION }}'
+          body: |
+            ${{ steps.release_note.outputs.stdout }}
+          labels: "Type: Release"
+
+      - name: Check Pull Request
+        run: |
+          echo "Pull Request Number - ${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}"
+          echo "Pull Request URL - ${STEPS_CPR_OUTPUTS_PULL_REQUEST_URL}"
+        env:
+          STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
+          STEPS_CPR_OUTPUTS_PULL_REQUEST_URL: ${{ steps.cpr.outputs.pull-request-url }}