Fix - npm publish trusted publishers

[alexpmule]

🔐 Enable NPM Trusted Publishers (OIDC) for Secure Package Publishing

Problem

The package publishing workflow was failing with authentication errors:

npm notice Access token expired or revoked
npm error 404 Not Found - PUT https://registry.npmjs.org/@api-components%2fapi-navigation

Solution

Implements NPM Trusted Publishers using OpenID Connect (OIDC) authentication, which provides a more secure and maintainable approach than static tokens.

Changes Made

1. Added OIDC Permissions

permissions:
  contents: write
  id-token: write  # Required for NPM Trusted Publishers

This allows GitHub Actions to generate temporary, scoped tokens verified by NPM.

2. Updated Actions to v4

• actions/checkout@v4 (from v2)
• actions/setup-node@v4 (from v2)

These versions provide better support for provenance generation and OIDC workflows.

3. Added Provenance Flag

npm publish --provenance --access public

Generates a cryptographic signature that proves the package was published from this repository.

Benefits

✅ Enhanced Security: Uses short-lived OIDC tokens instead of static secrets
✅ No Token Expiration: Tokens are generated automatically per workflow run
✅ Supply Chain Security: Provenance statements provide verifiable authenticity
✅ Reduced Maintenance: No need to rotate or manage NPM tokens
✅ Audit Trail: Cryptographically signed publish events

Testing Checklist

• Workflow runs successfully on merge to main
• Package publishes to npmjs.com with provenance
• Verify provenance badge appears on package page
• Confirm GitHub release is created with correct version

References & Documentation

NPM Trusted Publishers

• 📚 About NPM Provenance
• 📚 Trusted Publishing with OIDC
• 📚 Configuring Trusted Publishers

GitHub Actions

• 📚 OpenID Connect in GitHub Actions
• 📚 Automatic token authentication

Related Issues

• 🔗 NPM Trusted Publishers configuration set up by @jarrodek
• 🔗 Resolves authentication failures from previous workflow runs

How It Works

sequenceDiagram
    participant GHA as GitHub Actions
    participant NPM as NPM Registry
    
    GHA->>GHA: Generate OIDC token
    GHA->>NPM: Publish with provenance
    NPM->>NPM: Verify token signature
    NPM->>NPM: Check trusted publisher config
    NPM->>NPM: Validate repository match
    NPM-->>GHA: ✅ Publish successful
    NPM->>NPM: Store provenance statement

Loading

Post-Merge Verification

After merging, verify the provenance on the package page:

1. Visit: https://www.npmjs.com/package/@api-components/api-navigation
2. Look for the "Provenance" badge
3. Click to view the attestation details
4. Confirm it links back to this repository

---

Note: This workflow will still work with the NPM_TOKEN as a fallback if OIDC authentication is not available, but the primary authentication method is now via Trusted Publishers.

cc: @jarrodek - Thanks for setting up the Trusted Publishers configuration! 🎉