docs: Add README for nodejs/publish action (#2609)

Fixes #2528

---------

Signed-off-by: Ian Lewis <[email protected]>

Author: ianlewis

actions/nodejs/publish/README.md

@@ -0,0 +1,68 @@
+# publish
+
+The `actions/nodejs/publish` action provides a way to publish a Node.js package
+tarball and attestations generated by the
+[Node.js builder](../../../internal/builders/nodejs/README.md) to the
+[official npm registy](https://www.npmjs.com/).
+
+## Example
+
+Here is an example of building a Node.js package with the Node.js builder and
+publishing it using the `publish` action.
+
+```yaml
+jobs:
+  build:
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+    if: startsWith(github.ref, 'refs/tags/')
+    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+    with:
+      run-scripts: "ci, build"
+
+  publish:
+    needs: [build]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Node registry authentication
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+        with:
+          # Use the official npm registry.
+          registry-url: "https://registry.npmjs.org"
+
+      - name: publish
+        id: publish
+        uses: slsa-framework/slsa-github-generator/actions/nodejs/[email protected]
+        with:
+          access: public
+          node-auth-token: ${{ secrets.NPM_TOKEN }}
+          package-name: ${{ needs.build.outputs.package-name }}
+          package-download-name: ${{ needs.build.outputs.package-download-name }}
+          package-download-sha256: ${{ needs.build.outputs.package-download-sha256 }}
+          provenance-name: ${{ needs.build.outputs.provenance-name }}
+          provenance-download-name: ${{ needs.build.outputs.provenance-download-name }}
+          provenance-download-sha256: ${{ needs.build.outputs.provenance-download-sha256 }}
+```
+
+This will publish the tarball and provenance created built by the Node.js
+builder to the official registry.
+
+## Inputs
+
+| Name                         | Required | Default                                                          | Description                                                                                                                                          |
+| ---------------------------- | -------- | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `access`                     | no       | 'restricted' for scoped packages, 'public' for unscoped packages | The package access level. See [`npm help access`](https://docs.npmjs.com/cli/v9/commands/npm-access) for more information.                           |
+| `dist-tag`                   | no       | "latest"                                                         | The package dist-tag to attach. See [`npm help dist-tag`](https://docs.npmjs.com/cli/v9/commands/npm-dist-tag) for more information.                 |
+| `node-auth-token`            | yes      |                                                                  | The npm registry auth token used to publish the package. See [About access tokens](https://docs.npmjs.com/about-access-tokens) for more information. |
+| `package-name`               | yes      |                                                                  | The file name for the package tarball in the artifact.                                                                                               |
+| `package-download-name`      | yes      |                                                                  | The GitHub Actions artifact name for the package tarball.                                                                                            |
+| `package-download-sha256`    | yes      |                                                                  | The sha256 of the package tarball artifact.                                                                                                          |
+| `provenance-name`            | yes      |                                                                  | The file name for the package provenance in the artifact.                                                                                            |
+| `provenance-download-name`   | yes      |                                                                  | The GitHub Actions artifact name for the package provenance.                                                                                         |
+| `provenance-download-sha256` | yes      |                                                                  | The sha256 of the package provenance artifact.                                                                                                       |
+
+## Outputs
+
+There are no outputs.

internal/builders/nodejs/README.md

@@ -170,6 +170,10 @@ This action downloads the package tarball and provenance before running `npm
 publish` to publish your package to the npm registry. We provide a
 `node-auth-token` so that we can authenticate with `npmjs.com`.
 
+See the full documentation for the
+[`publish` action](../../../actions/nodejs/publish/README.md) for more
+information.
+
 #### Custom publishing
 
 After the package has been built you can publish on your own by downloading the