ci: use new shared publish workflow (#826)

Author: fadi-george

.github/workflows/cd.yml

@@ -0,0 +1,23 @@
+# Filename (cd.yml) should match the workflow filename in Trusted Publisher setting on npmjs
+name: Publish to NPM & Github
+on:
+  pull_request:
+    types:
+      - closed
+    branches:
+      - main
+      - rel/**
+
+permissions:
+  id-token: write # Required for OIDC
+  contents: write
+
+jobs:
+  publish:
+    if: |
+      github.event.pull_request.merged == true &&
+      contains(github.event.pull_request.title, 'chore: Release')
+    uses: OneSignal/sdk-actions/.github/workflows/publish-npm-github.yml@main
+    with:
+      branch: ${{ github.event.pull_request.base.ref }}
+      packages: '["com.onesignal.unity.core", "com.onesignal.unity.android", "com.onesignal.unity.ios"]'

.github/workflows/create-release-pr.yml

@@ -131,6 +131,9 @@ jobs:
   create-pr:
     needs: [prep, update-version]
     uses: OneSignal/sdk-actions/.github/workflows/create-release.yml@main
+    secrets:
+      # Need this cross-repo token (sdk-actions & this repo) to perform changes
+      GH_PUSH_TOKEN: ${{ secrets.GH_PUSH_TOKEN }}
     with:
       # Need target_repo otherwise caller would set github.repository to the caller itself (e.g. sdk-actions)
       target_repo: OneSignal/OneSignal-Unity-SDK
@@ -148,7 +151,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
         with:
+          repository: OneSignal/OneSignal-Unity-SDK
           ref: ${{ needs.prep.outputs.release_branch }}
+          token: ${{ secrets.GH_PUSH_TOKEN || github.token }}
 
       - name: Get PR release notes
         id: notes