ci: migrate to npm trusted publisher

.github/workflows/reusable-sdk-npm.yml

@@ -16,20 +16,14 @@ on:
         description: 'npm publish tag (e.g., latest, nightly)'
         default: ''
         type: string
-    secrets:
-      npm-token:
-        description: 'NPM auth token (required unless `dry-run: true`)'
-        required: false
 
 jobs:
   publish-npm:
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/publish-npm.yml@publish-npm-v1.5.0
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/publish-npm.yml@publish-npm-v1.6.0
     with:
       scope: '@iexec/web3telegram'
       tag: ${{ inputs.tag }}
       version: ${{ inputs.version }}
       environment: ${{ (inputs.dry-run && '') || inputs.tag }}
       provenance: ${{ !inputs.dry-run }}
       dry-run: ${{ inputs.dry-run }}
-    secrets:
-      npm-token: ${{ secrets.npm-token }}

.github/workflows/sdk-publish-npm.yml

@@ -0,0 +1,49 @@
+# ⚠️ THIS WORKFLOW IS THE TRUSTED PUBLISHER CONFIGURED ON NPMJS.COM, DO NOT RENAME OR DELETE THIS FILE ⚠️
+name: Publish NPM Package
+
+on:
+  # For staging releases
+  workflow_dispatch:
+  # For latest releases
+  release:
+    types: [published]
+
+permissions:
+  id-token: write # Required for OIDC
+  packages: write
+  contents: read
+
+jobs:
+  set-staging-version:
+    # Only run for manual dispatch on main branch
+    if: ${{ github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+      - name: Set publish version
+        id: set-staging-version
+        run: |
+          CURRENT_VERSION=$(npm pkg get version | tr -d '"')
+          NIGHTLY_VERSION="${CURRENT_VERSION}-nightly-${GITHUB_SHA::7}"
+          echo "VERSION=${NIGHTLY_VERSION}" >> $GITHUB_OUTPUT
+    outputs:
+      VERSION: ${{ steps.set-staging-version.outputs.VERSION }}
+
+  publish-npm-staging:
+    # Only run for manual dispatch on main branch
+    if: ${{ github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' }}
+    uses: ./.github/workflows/reusable-sdk-npm.yml
+    needs: set-staging-version
+    with:
+      tag: ${{ github.event.inputs.tag }}
+      version: ${{ needs.set-staging-version.outputs.VERSION }}
+
+  publish-npm-latest:
+    # # Only run for release published with tag "web3telegram-v*"
+    if: ${{ github.event_name == 'release' && startsWith(github.ref_name,'web3telegram-v') }}
+    uses: ./.github/workflows/reusable-sdk-npm.yml
+    with:
+      tag: 'latest'