Automate publish to npm

[Pytal]

Add a workflow to publish this package to npm on release, also needs an NPM_TOKEN secret :)

Similar to the workflows as seen in the eslint-config and webpack-vue-config repos.

[juliushaertl]

@skjnldsv @LukasReschke What is the state with npm tokens on repos inside this org these days? Wasn't this something we abandonded due to the large amount of people with push access?

[Pytal]

Drafting pending discussions :)

[LukasReschke]

Let's either use a locked down environment or if that isn't feasible the https://github.com/nextcloud-releases organization? :)

[Pytal]

@ChristophWurst @juliushaertl @LukasReschke forked to https://github.com/nextcloud-releases/nextcloud-typings — as noted in nextcloud-libraries/nextcloud-password-confirmation#220 (review) we'll also have to set the secret token in the new repo or at the organization level :)

[ChristophWurst]

But you still add the workflow here. Then we tag releases here and also push them over to the fork. Only in the forked repo the workflow should run. You could add something like an condition that the workflow only runs when the npm token is available.

[skjnldsv]

I think there is also a way to check the author permission level for the release in the github action.
Meaning we could deny if the level is not Admin or Owner

[Pytal]

I think there is also a way to check the author permission level for the release in the github action.
Meaning we could deny if the level is not Admin or Owner

Couldn't find that in the docs 🤔 made a PR with @ChristophWurst's suggestion in the https://github.com/nextcloud/.github repo

[Pytal]

Closing in favour of nextcloud/.github#14

[skjnldsv]

Couldn't find that in the docs

That would be a workflow step, not from github's docs :)

[skjnldsv]

Did a small PoC, Works fine!

I'll create a PR to the github action

[skjnldsv]

PR in actions-cool/check-user-permission#3