build: modfying publish action to use npm cli to include provenance in npm publish (#319)

**Requirements**

- [ ] I have added test coverage for new or changed functionality
- [ ] I have followed the repository's [pull request submission
guidelines](../blob/main/CONTRIBUTING.md#submitting-pull-requests)
- [ ] I have validated my changes against all supported platform
versions

**Related issues**

**Describe the solution you've provided**

Yarn publish doesn't currently support NPM's publish package with
provenance functionality. As a workaround until this is supported, we'll
pack the workspace with yarn in order to guarantee we get the same
package as before, and then use the npm cli to do the final publish with
provenance. This also involves passing the workspace path as input
parameters to the publish actions/script as npm's workspace
functionality doesn't work exactly the same as yarns.

While npm's generated provenance isn't the most robust provenance
attestation, it results in a verified checkmark on the npm package page,
which brings the provenance closest to the consumer and makes it most
useful.

**Describe alternatives you've considered**

Ideally we'd want yarn to support this natively, but tracking the yarn
repo issues for the past couple months has shown no movement here.

**Additional context**

Add any other context about the pull request here.

Author: rsoberano-ld

.github/workflows/manual-publish.yml

@@ -41,6 +41,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - name: 'Setup Redis'
         if: ${{ inputs.workspace_path == 'packages/store/node-server-sdk-redis' }}
         run: |
@@ -80,5 +83,6 @@ jobs:
         uses: ./actions/publish
         with:
           workspace_name: ${{ env.WORKSPACE_NAME }}
+          workspace_path: ${{ inputs.workspace_path }}
           prerelease: ${{ inputs.prerelease }}
           dry_run: ${{ inputs.dry_run }}

.github/workflows/release-please.yml

@@ -40,6 +40,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/shared/common
         uses: ./actions/full-release
@@ -60,6 +63,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/shared/sdk-server
         uses: ./actions/full-release
@@ -80,6 +86,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/shared/sdk-server-edge
         uses: ./actions/full-release
@@ -100,6 +109,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/shared/akamai-edgeworker-sdk
         uses: ./actions/full-release
@@ -120,6 +132,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/cloudflare
         uses: ./actions/full-release
@@ -140,6 +155,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/server-node
         uses: ./actions/full-release
@@ -160,6 +178,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/vercel
         uses: ./actions/full-release
@@ -180,6 +201,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/akamai-base
         uses: ./actions/full-release
@@ -200,6 +224,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/akamai-edgekv
         uses: ./actions/full-release
@@ -220,6 +247,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - run: |
           sudo apt-get update
           sudo apt-get install redis-server
@@ -244,6 +274,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - run: |
           sudo docker run -d -p 8000:8000 amazon/dynamodb-local
       - id: release-common

actions/full-release/action.yml

@@ -34,6 +34,7 @@ runs:
     - uses: ./actions/publish
       with:
         workspace_name: ${{ env.WORKSPACE_NAME }}
+        workspace_path: ${{ inputs.workspace_path }}
         prerelease: false
         dry_run: false
     - uses: ./actions/publish-docs

actions/install-npm-version/action.yml

@@ -0,0 +1,16 @@
+name: Install npm version
+# Used to specify a version of npm that supports --provenance (for node installs < 18.X)
+description: Install the latest version of the npm CLI utility. 
+inputs:
+  npm_version:
+    description: 'The version of npm to install'
+    required: false
+    default: latest
+
+runs:
+  using: composite
+  steps:
+    - name: 'Install specified npm version'
+      shell: bash
+      run: |
+        npm install -g npm@${{ inputs.npm_version }}

actions/publish/action.yml

@@ -4,6 +4,9 @@ inputs:
   workspace_name:
     description: 'The workspace to publish'
     required: true
+  workspace_path:
+    description: 'Path to the workspace (for npm publish)'
+    required: true
   prerelease:
     description: 'Is this a prerelease. If so, then the latest tag will not be updated in npm.'
     required: true
@@ -21,5 +24,6 @@ runs:
         ./scripts/publish.sh
       env:
         WORKSPACE: ${{ inputs.workspace_name }}
+        WORKSPACE_PATH: ${{ inputs.workspace_path }}
         LD_RELEASE_IS_PRERELEASE: ${{ inputs.prerelease }}
         LD_RELEASE_IS_DRYRUN: ${{ inputs.dry_run }}

scripts/publish.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
+yarn workspace $WORKSPACE pack
 if $LD_RELEASE_IS_DRYRUN ; then
   # Dry run just pack the workspace.
   echo "Doing a dry run of publishing."
-  yarn workspace $WORKSPACE pack
 else
   if $LD_RELEASE_IS_PRERELEASE ; then
     echo "Publishing with prerelease tag."
-    yarn workspace $WORKSPACE npm publish --tag prerelease || { echo "npm publish failed" >&2; exit 1; }
+    npm publish --tag prerelease --provenance --access public "./$WORKSPACE_PATH/package.tgz" || { echo "npm publish failed" >&2; exit 1; }
   else
-    yarn workspace $WORKSPACE npm publish || { echo "npm publish failed" >&2; exit 1; }
+    npm publish --provenance --access public "./$WORKSPACE_PATH/package.tgz" || { echo "npm publish failed" >&2; exit 1; }
   fi
 fi