chore(ci): Switch to npm trusted publishing (#6152)

Author: davidkna-sap

.github/workflows/build.yml

@@ -7,9 +7,7 @@ on:
     tags: ['v*']
     paths-ignore:
       - 'docs/**'
-  schedule:
-    - cron: '0 1 * * *'
-  workflow_dispatch:
+  workflow_call:
     inputs:
       canary-release:
         description: 'Release canary version (skips tests and checks)'
@@ -136,7 +134,7 @@ jobs:
           PR_URL: ${{github.event.pull_request.html_url}}
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
   canary-release-pre-check:
-    if: github.event_name == 'schedule'
+    if: github.event_name == 'workflow_call' && inputs.canary-release == false
     runs-on: ubuntu-latest
     outputs:
       skip-release: ${{ steps.date-check.outputs.skip-release }}
@@ -169,12 +167,14 @@ jobs:
     if: always() && (needs.canary-release-pre-check.outputs.skip-release == 'false' || inputs.canary-release == true)
     runs-on: ubuntu-latest
     needs: [canary-release-pre-check]
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v5
       - run: git fetch --depth=1
       - uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24 # Will install npm 11 needed for trusted publishing
           cache: 'yarn'
           registry-url: 'https://registry.npmjs.org'
       - run: yarn install --frozen-lockfile --ignore-engines
@@ -187,8 +187,6 @@ jobs:
           yarn changeset version
           yarn changeset pre exit
           yarn changeset publish --tag canary
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPMJS_ACCESS_TOKEN }}
   draft-github-release:
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest

.github/workflows/release-entry.yml

@@ -0,0 +1,30 @@
+# This workflow delegates to the appropriate release workflow based on the event that triggered it.
+name: release-entry
+
+on:
+  # Triggers for official releases
+  release:
+    types: [published]
+  # Triggers for canary releases
+  schedule:
+    - cron: '0 1 * * *'
+
+  workflow_dispatch:
+    inputs:
+      canary-release:
+        description: 'Release canary version (skips tests and checks)'
+        type: boolean
+        required: false
+        default: false
+jobs:
+  delegate_to_release_job:
+    if: ${{ github.event_name == 'release' }}
+    uses: ./.github/workflows/release.yml
+    secrets: inherit
+
+  delegate_to_canary_job:
+    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+    uses: ./.github/workflows/build.yml
+    secrets: inherit
+    with:
+      canary-release: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.canary-release || github.event_name != 'schedule' }}

.github/workflows/release.yml

@@ -1,33 +1,31 @@
 name: release
 
 on:
-  release:
-    types: [published]
+  workflow_call:
 
 jobs:
   stable-release:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      
     steps:
       - uses: actions/checkout@v5
         with:
           ref: 'main'
       - uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24 # Will install npm 11 needed for trusted publishing
           registry-url: 'https://registry.npmjs.org'
       - run: yarn install --frozen-lockfile --ignore-engines
       - name: Legacy Release
         if: startsWith(github.ref, 'refs/tags/v1') || startsWith(github.ref, 'refs/tags/v2') || startsWith(github.ref, 'refs/tags/v3')
         run: |
           yarn changeset publish --tag legacy
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPMJS_ACCESS_TOKEN }}
       - name: Latest Release
         if: startsWith(github.ref, 'refs/tags/v4')
         run: |
           yarn changeset publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPMJS_ACCESS_TOKEN }}
       - name: Checkout Docs
         uses: actions/checkout@v5
         with:

packages/connectivity/package.json

@@ -23,7 +23,11 @@
     "internal.js",
     "internal.d.ts"
   ],
-  "repository": "github:SAP/cloud-sdk-js",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/SAP/cloud-sdk-js.git",
+    "directory": "packages/connectivity"
+  },
   "scripts": {
     "compile": "tsc -b",
     "prepublishOnly": "yarn compile && yarn readme",

packages/eslint-config/package.json

@@ -20,7 +20,11 @@
     "index.js",
     "flat-config.js"
   ],
-  "repository": "github:SAP/cloud-sdk-js",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/SAP/cloud-sdk-js.git",
+    "directory": "packages/eslint-config"
+  },
   "scripts": {
     "readme": "ts-node ../../scripts/replace-common-readme.ts"
   },

packages/generator-common/package.json

@@ -23,7 +23,11 @@
     "internal.js",
     "internal.d.ts"
   ],
-  "repository": "github:SAP/cloud-sdk-js",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/SAP/cloud-sdk-js.git",
+    "directory": "packages/generator-common"
+  },
   "scripts": {
     "compile": "tsc -b",
     "prepublishOnly": "yarn compile && yarn readme",

packages/generator/package.json

@@ -26,7 +26,11 @@
     "internal.d.ts",
     "internal.js"
   ],
-  "repository": "github:SAP/cloud-sdk-js",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/SAP/cloud-sdk-js.git",
+    "directory": "packages/generator"
+  },
   "scripts": {
     "compile": "tsc -b",
     "prepublishOnly": "yarn compile && yarn readme",

packages/http-client/package.json

@@ -23,7 +23,11 @@
     "internal.js",
     "internal.d.ts"
   ],
-  "repository": "github:SAP/cloud-sdk-js",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/SAP/cloud-sdk-js.git",
+    "directory": "packages/http-client"
+  },
   "scripts": {
     "compile": "tsc -b",
     "prepublishOnly": "yarn compile && yarn readme",

packages/odata-common/package.json

@@ -23,7 +23,11 @@
     "internal.js",
     "internal.d.ts"
   ],
-  "repository": "github:SAP/cloud-sdk-js",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/SAP/cloud-sdk-js.git",
+    "directory": "packages/odata-common"
+  },
   "scripts": {
     "compile": "tsc -b",
     "prepublishOnly": "yarn compile && yarn readme",

packages/odata-v2/package.json

@@ -23,7 +23,11 @@
     "internal.js",
     "internal.d.ts"
   ],
-  "repository": "github:SAP/cloud-sdk-js",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/SAP/cloud-sdk-js.git",
+    "directory": "packages/odata-v2"
+  },
   "scripts": {
     "compile": "tsc -b",
     "prepublishOnly": "yarn compile && yarn readme",