ci: Update publishing for OIDC trusted publishing (#294)

Author: rbarker-dev

.github/workflows/npm-publish.yml

@@ -2,30 +2,38 @@ name: NPM Publish
 
 on:
   workflow_dispatch:
+    inputs:
+      dry-run-enabled:
+        description: 'Enable dry run for publishing (does not publish to npmjs)'
+        required: false
+        default: false
+        type: boolean
 
 permissions:
+  id-token: write
   contents: read
 
 jobs:
-  publish:
-    name: Publish NPM package
+  build-npm-package:
+    name: Build NPM package
     runs-on: smart-contracts-linux-medium
+    outputs:
+      npm-artifact-name: ${{ steps.set-publish-data.outputs.artifact-name }}
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+      - name: Prepare Runner
+        uses: pandaswhocode/initialize-github-job@ed4a98646fe0235e6ecf3af5414b355d2abe3bf3 # v1.0.3
         with:
-          egress-policy: audit
-
-      - name: Checkout Code
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-        with:
-          submodules: recursive
+          checkout: 'true'
+          checkout-ref: '${{ github.ref }}'
+          checkout-token: '${{ secrets.GITHUB_TOKEN }}'
+          checkout-fetch-depth: '1'
+          setup-node: 'true'
+          node-version: '20'
 
-      - name: Set up Node.js
-        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
+      - name: Setup JQ
+        uses: dcarbone/install-jq-action@b7ef57d46ece78760b4019dbc4080a1ba2a40b45 # v3.2.0
         with:
-          node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
+          version: 1.7
 
       - name: Install Foundry
         uses: step-security/foundry-toolchain@01e2d127ea061e2ce8fa34340de71ca8518f093e # v1.2.1
@@ -41,7 +49,55 @@ jobs:
       - name: Run Unit Tests
         run: npm run test
 
-      - name: Publish NPM package
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Set Publish Data
+        id: set-publish-data
+        run: |
+          VERSION=$(jq -r '.version' './package.json')
+          NPM_PACKAGE_NAME="hashgraph-system-contracts-forking-${VERSION}.tgz"
+          echo "artifact-name=${NPM_PACKAGE_NAME}" >> "${GITHUB_OUTPUT}"
+
+      - name: Build NPM package
+        run: npm pack
+
+      - name: Upload Hedera Custodians Library Package Artifact
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: npm-package
+          path: ./${{ steps.set-publish-data.outputs.artifact-name }}
+          if-no-files-found: error
+
+  publish-npm-package:
+    runs-on: ubuntu-latest
+    needs:
+      - build-npm-package
+    steps:
+      - name: Prepare Runner
+        uses: pandaswhocode/initialize-github-job@ed4a98646fe0235e6ecf3af5414b355d2abe3bf3 # v1.0.3
+        with:
+          checkout: 'true'
+          checkout-ref: '${{ github.ref }}'
+          checkout-fetch-depth: '1'
+          checkout-token: '${{ secrets.GITHUB_TOKEN }}'
+          setup-node: 'true'
+          node-version: '20'
+          node-registry: 'https://registry.npmjs.org'
+
+      - name: Install NPM latest
+        run: npm install -g npm@11.7.0
+
+      - name: Download Hedera Custodians Library NPM Package
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: npm-package
+
+      - name: Publish NPM Package
+        run: |
+          args="--access=public"
+          if [[ "${{ inputs.dry-run-enabled || 'false' }}" == "true" ]]; then
+            args="${args} --dry-run"
+          fi
+
+          package="${{ needs.build-npm-package.outputs.npm-artifact-name }}"
+          echo "::group::Publishing package: ${package} with args: ${args}"
+          npm publish ${package} ${args}
+          echo "::endgroup::"

.gitignore

@@ -18,3 +18,7 @@
 # `reports-dir`: directory where coverage reports will be output to	
 # https://github.com/bcoe/c8?tab=readme-ov-file#cli-options--configuration
 /coverage/
+
+# IDEA
+**/.DS_Store
+**/.idea/