ci(evaluation): publish typescript package with npm oidc

.github/workflows/pr-evaluation-ts.yaml

@@ -14,7 +14,6 @@ concurrency:
 
 env:
   NODE_VERSION: 20
-  NPM_TOKEN: ${{ secrets.NPM_TOKEN || '' }}
   EVALUATION_DIRECTORY: "evaluation/typescript"
 
 jobs:

.github/workflows/publish-evaluation-ts.yaml

@@ -0,0 +1,61 @@
+name: Publish TypeScript evaluation to npm
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Dry run (do not actually publish)"
+        required: false
+        default: false
+        type: boolean
+
+env:
+  NODE_VERSION: 20
+  EVALUATION_DIRECTORY: "evaluation/typescript"
+
+permissions:
+  contents: read
+  id-token: write # required for npm OIDC trusted publishing
+
+jobs:
+  publish:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ${{ env.EVALUATION_DIRECTORY }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Setup node env
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install Protoc
+        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
+
+      # npm >= 11.5.1 is required for OIDC trusted publishing.
+      # Keep this aligned with the npm version used by the SDK publish workflows.
+      - name: Ensure npm supports OIDC trusted publishing
+        run: npm install -g npm@11.10.0
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Generate protobuf code
+        run: make gen_proto
+
+      - name: Build evaluation package
+        run: make build
+
+      - name: Publish to npm via OIDC
+        run: |
+          make copy-genfiles
+          npm publish \
+            --provenance \
+            --access public \
+            ${{ inputs.dry_run && '--dry-run' || '' }}

evaluation/typescript/README.md

@@ -5,7 +5,6 @@
 ### Setup
 
 ```sh
-export NPM_TOKEN="YOUR_NPM_TOKEN"
 make init
 make gen_proto
 ```
@@ -30,10 +29,23 @@ make lint
 
 ## Release to NPM
 
-```sh
-export NPM_TOKEN="YOUR_NPM_TOKEN"
-make init
-make gen_proto
-make build
-make publish
-```
+Publishing is run manually with the
+[`Publish TypeScript evaluation to npm`](https://github.com/bucketeer-io/bucketeer/actions/workflows/publish-evaluation-ts.yaml)
+GitHub Actions workflow.
+
+Before the first release, configure an npm trusted publisher for
+`@bucketeer/evaluation` with:
+
+- Organization or user: `bucketeer-io`
+- Repository: `bucketeer`
+- Workflow filename: `publish-evaluation-ts.yaml`
+
+To release a new version:
+
+1. Update the version in `package.json`.
+2. Merge the change into `main`.
+3. Run the workflow from the `main` branch. Enable `dry_run` to verify the
+   package without publishing it.
+
+The workflow builds and publishes the package with npm trusted publishing
+(OIDC), so an npm token is not required.

evaluation/typescript/package.json

@@ -1,11 +1,18 @@
 {
   "name": "@bucketeer/evaluation",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "description": "",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "author": "",
   "license": "ISC",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "lib",
+    "README.md"
+  ],
   "dependencies": {
     "@types/fnv-plus": "^1.3.2",
     "@types/google-protobuf": "^3.15.12",