feat: add npm OIDC trusted publishing support

[GarthDB]

This PR adds support for npm's OIDC-based trusted publishing, which lets you publish packages without managing long-lived NPM tokens.

What this addresses

Closes #542 and helps with #515 by enabling OIDC in the current workflow model. Related to #545 but takes a more comprehensive approach.

Changes

Added a new oidcAuth input parameter (defaults to false for backward compatibility). When enabled, the action validates your OIDC environment before trying to publish:

• Checks you're running npm 11.5.1+ (requirement for OIDC)
• Verifies id-token: write permission is set
• Detects if you accidentally left NPM_TOKEN set (conflicting auth)

The implementation explicitly passes OIDC environment variables to the publish command. This is necessary because some toolchains spawn fresh shell processes, and we need to ensure the OIDC tokens reach npm even through those layers.

Testing

I've been testing this in production at Adobe (spectrum-design-data repo) and added comprehensive test coverage:

• 9 unit tests for OIDC validation logic
• 13 integration tests for authentication setup
• Automated test workflow with 4 different scenarios

All 30 tests pass locally.

How to use it

permissions:
  contents: write
  pull-requests: write
  id-token: write  # This is the key addition

jobs:
  release:
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - run: npm install -g npm@latest  # Get npm 11.5.1+

      - uses: changesets/action@v1
        with:
          publish: yarn release
          oidcAuth: true  # Enable OIDC
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # No NPM_TOKEN needed!

You'll also need to configure trusted publishing on npmjs.com for your packages (one-time setup).

Why this approach vs PR #545

PR #545 just prevents writing undefined to .npmrc, but doesn't validate the environment or provide any feedback when things are misconfigured. This implementation validates upfront and gives you clear error messages if something's wrong, which saves a lot of debugging time.

Backward compatibility

Fully backward compatible - existing workflows using NPM_TOKEN continue to work unchanged. OIDC is opt-in via the new parameter.

[changeset-bot]

⚠️ No Changeset found

Latest commit: b7f2e60

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR