chore(ci): use OIDC for NPM publishing (#641)

Author: pascal-botpress

.github/workflows/const.yml

@@ -18,6 +18,10 @@ defaults:
   run:
     working-directory: ./depsynky
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   depsynky:
     runs-on: ubuntu-latest
@@ -40,4 +44,3 @@ jobs:
         uses: botpress/gh-actions/publish-if-not-exists@master
         with:
           path: './depsynky'
-          token: '${{ secrets.NPM_ACCESS_TOKEN }}'

.github/workflows/depsynky.yml

@@ -18,6 +18,10 @@ defaults:
   run:
     working-directory: ./entities
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   entities:
     runs-on: ubuntu-latest
@@ -40,4 +44,3 @@ jobs:
         uses: botpress/gh-actions/publish-if-not-exists@master
         with:
           path: './entities'
-          token: '${{ secrets.NPM_ACCESS_TOKEN }}'

.github/workflows/entities.yml

@@ -18,6 +18,10 @@ defaults:
   run:
     working-directory: ./es-node
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   es-node:
     runs-on: ubuntu-latest
@@ -39,4 +43,3 @@ jobs:
         uses: botpress/gh-actions/publish-if-not-exists@master
         with:
           path: './es-node'
-          token: '${{ secrets.NPM_ACCESS_TOKEN }}'

.github/workflows/es-node.yml

@@ -18,6 +18,10 @@ defaults:
   run:
     working-directory: ./genenv
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   genenv:
     runs-on: ubuntu-latest
@@ -40,4 +44,3 @@ jobs:
         uses: botpress/gh-actions/publish-if-not-exists@master
         with:
           path: './genenv'
-          token: '${{ secrets.NPM_ACCESS_TOKEN }}'

.github/workflows/genenv.yml

@@ -18,6 +18,10 @@ defaults:
   run:
     working-directory: ./jex
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   jex:
     runs-on: ubuntu-latest
@@ -41,4 +45,3 @@ jobs:
         uses: botpress/gh-actions/publish-if-not-exists@master
         with:
           path: './jex'
-          token: '${{ secrets.NPM_ACCESS_TOKEN }}'

.github/workflows/jex.yml

@@ -18,6 +18,10 @@ defaults:
   run:
     working-directory: ./log4bot
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   log4bot:
     runs-on: ubuntu-latest
@@ -40,4 +44,3 @@ jobs:
         uses: botpress/gh-actions/publish-if-not-exists@master
         with:
           path: './log4bot'
-          token: '${{ secrets.NPM_ACCESS_TOKEN }}'

.github/workflows/log4bot.yml

@@ -18,6 +18,10 @@ defaults:
   run:
     working-directory: ./opapi
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   opapi:
     runs-on: ubuntu-latest
@@ -41,4 +45,3 @@ jobs:
         uses: botpress/gh-actions/publish-if-not-exists@master
         with:
           path: './opapi'
-          token: '${{ secrets.NPM_ACCESS_TOKEN }}'

.github/workflows/opapi.yml

@@ -18,6 +18,10 @@ defaults:
   run:
     working-directory: ./promex
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   promex:
     runs-on: ubuntu-latest
@@ -40,4 +44,3 @@ jobs:
         uses: botpress/gh-actions/publish-if-not-exists@master
         with:
           path: './promex'
-          token: '${{ secrets.NPM_ACCESS_TOKEN }}'

.github/workflows/promex.yml

@@ -18,6 +18,10 @@ defaults:
   run:
     working-directory: ./ptb-schema
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   ptb-schema:
     runs-on: ubuntu-latest
@@ -40,4 +44,3 @@ jobs:
         uses: botpress/gh-actions/publish-if-not-exists@master
         with:
           path: './ptb-schema'
-          token: '${{ secrets.NPM_ACCESS_TOKEN }}'