WMSDK-0000: Add trusted publishing

.github/workflows/publish-common-trigger.yml.yml

@@ -0,0 +1,36 @@
+name: 2. SDK publish RC manual or from master/support
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [closed]
+    branches:
+    - 'master'
+    - 'support/*'
+
+jobs:
+  check-branch-for-manual:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+    - name: Check if branch matches pattern
+      run: |
+        if ! echo "${{ github.ref_name }}" | grep -q "release/.*-rc"; then
+          echo "Branch name must match pattern 'release/*-rc'"
+          exit 1
+        fi
+
+  publish-manual:
+    if: github.event_name == 'workflow_dispatch'
+    needs: check-branch-for-manual
+    uses: ./.github/workflows/publish-reusable.yml
+    with:
+      branch: ${{ github.ref_name }}
+    secrets: inherit
+
+  publish-from-pr:
+    if: github.event_name == 'pull_request' && github.event.pull_request.merged == true
+    uses: ./.github/workflows/publish-reusable.yml
+    with:
+      branch: ${{ github.base_ref }}
+    secrets: inherit

.github/workflows/publish-reusable.yml

@@ -6,6 +6,10 @@ on:
       branch:
         required: true
         type: string
+
+permissions:
+  id-token: write
+  contents: write
 
 jobs:
   checkingVersion:
@@ -41,9 +45,9 @@ jobs:
       with:
         ref: ${{ inputs.branch }}
     - name: Setup node JS
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@v4
       with:
-        node-version: 14
+        node-version: 'lts/*'
         registry-url: https://registry.npmjs.org
     - name: Setup local environment
       run: yarn
@@ -81,9 +85,9 @@ jobs:
         fi
     - name: Release
       env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_CICD_SECRET }}
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
+        npm install -g npm@latest
         if [ ${{ steps.prerelease_check.outputs.is_prerelease }} == "true" ]; then
           yarn release ${{ needs.checkingVersion.outputs.newVersion }} --pre-release --no-plugins.@release-it/keep-a-changelog.strictLatest --ci
         else

package.json

@@ -100,7 +100,8 @@
       "after:bump": "npx auto-changelog -p"
     },
     "npm": {
-      "publish": true
+      "publish": true,
+      "skipChecks": true
     },
     "github": {
       "release": true