Add OIDC to rc branch

[andy-chhuon]

Background

Migrate from npm to OIDC according to docs to avoid 404 error

Also see, #3650 (comment)

[fatbattk]

Update

• Modified to centralize to deploy.yml because npm OIDC only allows one publish flow file.
  • Works for deploy-rc consolidation but may need different strategy with the snap shots and other flows.
• Safe to merge and test as publishing to npm does not work now.

[andy-chhuon]

Thanks @fatbattk, makes sense!

context on pr:
slack

context on why only one publish file:
Slack & OIDC docs (control-F for '404' - vault doesn't link correctly)

Snapit won't work as it currently does not support OIDC (currently doesn't work either with NPM token)

[aaronschubert0]

@andy-chhuon do you know what version added support for OIDC or is pinning it to a commit hash not compatible with OIDC? It would be good to keep pinned to a specific version so we don't automatically opt-into new versions.

[andy-chhuon]

Good point, this was what is recommended in the docs but pinning it to a version makes sense. I pinned it to the latest version just in case and it's a version used throughout shopify too

[aaronschubert0]

Great, thanks @andy-chhuon ! Surprisingly the intro image does have a pinned version. Could you ping the team that owns the page about the discrepancy and ask them to update it?

[andy-chhuon]

Ah interesting, will do!