Merge pull request #1191 from rescript-lang/agent/npm-trusted-publishing

Activate NPM trusted publishing

Author: fhammerschmidt

.github/workflows/ci.yml

@@ -316,31 +316,63 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/')
         run: npx vsce publish --pat ${{ secrets.MARKETPLACE_TOKEN }} ${{ steps.tag_name.outputs.tag }} --no-git-tag-version
 
-      - name: Publish LSP as pre-release to NPM
-        if: github.ref == 'refs/heads/master'
+      - name: Package LSP for NPM
+        if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
         working-directory: server
         run: |
-          npm version preminor --preid next-$(git rev-parse --short HEAD)
-          npm publish --access public --tag next
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Publish LSP to NPM
-        if: startsWith(github.ref, 'refs/tags/')
-        working-directory: server
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          if [[ "$GITHUB_REF" == "refs/heads/master" ]]; then
+            npm version preminor --preid next-$(git rev-parse --short HEAD)
+          fi
+          mkdir -p ../npm-packages
+          npm pack --pack-destination ../npm-packages
 
       - name: Build @rescript/tools package
         working-directory: tools
         run: |
           npm ci
           npm run build
 
-      - name: Publish @rescript/tools package
+      - name: Package @rescript/tools for NPM
         if: ${{ startsWith(github.event.head_commit.message, 'publish tools') && (github.ref == 'refs/heads/master') }}
         working-directory: tools
-        run: npm publish --access public
+        run: npm pack --pack-destination ../npm-packages
+
+      - name: Upload NPM packages
+        if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
+        uses: actions/upload-artifact@v4
+        with:
+          name: npm-packages
+          path: npm-packages/*.tgz
+          retention-days: 1
+
+  publish-npm:
+    name: Publish NPM packages
+    needs: package
+    if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Use Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false
+
+      - name: Download NPM packages
+        uses: actions/download-artifact@v4
+        with:
+          name: npm-packages
+          path: packages
+
+      - name: Publish LSP to NPM
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TAG: ${{ github.ref == 'refs/heads/master' && 'next' || 'latest' }}
+        run: npm publish packages/rescript-language-server-*.tgz --access public --tag "$NPM_TAG"
+
+      - name: Publish @rescript/tools package
+        if: ${{ startsWith(github.event.head_commit.message, 'publish tools') && (github.ref == 'refs/heads/master') }}
+        run: npm publish packages/rescript-tools-*.tgz --access public