ci: Set up OIDC npm publishing (#770)

- closes #732
- see discussion in #768

Author: janbuchar

.github/workflows/pre_release.yaml

@@ -80,28 +80,8 @@ jobs:
         needs: [update_changelog, wait_for_checks]
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v5
+            - name: Execute publish workflow
+              uses: apify/workflows/execute-workflow@execute-workflow-action
               with:
-                  ref: ${{ needs.update_changelog.outputs.changelog_commitish }}
-            - name: Use Node.js 22
-              uses: actions/setup-node@v6
-              with:
-                  node-version: 22
-                  cache: 'npm'
-                  cache-dependency-path: 'package-lock.json'
-            - name: Install dependencies
-              run: |
-                  echo "access=public" >> .npmrc
-                  echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> .npmrc
-                  npm ci
-            - # Check version consistency and increment pre-release version number for beta only.
-              name: Bump pre-release version
-              run: node ./.github/scripts/before-beta-release.js
-            - name: Build module
-              run: npm run build
-            - name: Publish to NPM
-              run: npm publish --tag beta
-
-env:
-    NODE_AUTH_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_NPM_TOKEN }}
-    NPM_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_NPM_TOKEN }}
+                  workflow: publish_to_npm.yaml
+                  inputs: '{ "ref": "${{ needs.update_changelog.outputs.changelog_commitish }}", "tag": "beta" }'

.github/workflows/publish_to_npm.yaml

@@ -0,0 +1,46 @@
+name: Publish to NPM
+
+on:
+    workflow_dispatch:
+        inputs:
+            ref:
+                description: Git ref to publish (branch, tag, or commit SHA)
+                required: true
+                type: string
+            tag:
+                description: NPM dist-tag
+                required: true
+                type: choice
+                default: latest
+                options:
+                    - latest
+                    - beta
+
+permissions:
+    id-token: write # Required for OIDC
+    contents: read
+
+jobs:
+    publish_to_npm:
+        name: Publish to NPM
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v5
+              with:
+                  ref: ${{ inputs.ref }}
+            - name: Use Node.js 22
+              uses: actions/setup-node@v6
+              with:
+                  node-version: 22
+                  cache: 'npm'
+                  cache-dependency-path: 'package-lock.json'
+            - name: Install dependencies
+              run: |
+                  npm ci
+            - name: Check version consistency and bump pre-release version (beta only)
+              if: ${{ inputs.tag == 'beta' }}
+              run: node ./.github/scripts/before-beta-release.js
+            - name: Build module
+              run: npm run build
+            - name: Publish to NPM
+              run: npm publish --tag ${{ inputs.tag }}

.github/workflows/release.yaml

@@ -102,24 +102,11 @@ jobs:
         needs: [update_changelog]
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v5
+            - name: Execute publish workflow
+              uses: apify/workflows/execute-workflow@execute-workflow-action
               with:
-                  ref: ${{ needs.update_changelog.outputs.changelog_commitish }}
-            - name: Use Node.js 22
-              uses: actions/setup-node@v6
-              with:
-                  node-version: 22
-                  cache: 'npm'
-                  cache-dependency-path: 'package-lock.json'
-            - name: Install dependencies
-              run: |
-                  echo "access=public" >> .npmrc
-                  echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> .npmrc
-                  npm ci
-            - name: Build module
-              run: npm run build
-            - name: Publish to NPM
-              run: npm publish --tag latest
+                  workflow: publish_to_npm.yaml
+                  inputs: '{ "ref": "${{ needs.update_changelog.outputs.changelog_commitish }}", "tag": "latest" }'
 
     version-docs:
         needs: publish_to_npm
@@ -167,7 +154,3 @@ jobs:
                   author_name: Apify Release Bot
                   author_email: [email protected]
                   message: 'docs: update docs for ${{ inputs.version }} version'
-
-env:
-    NODE_AUTH_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_NPM_TOKEN }}
-    NPM_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_NPM_TOKEN }}