chore: oidc npm workflow

Author: NathanWalker

.github/scripts/npm-publish-ci.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TAG="${NPM_TAG:-next}"
+
+args=(
+  --tag "$TAG"
+  --access public
+  --provenance
+)
+
+log_file="$(mktemp)"
+
+set +e
+npm publish "${args[@]}" 2>&1 | tee "$log_file"
+status=${PIPESTATUS[0]}
+set -e
+
+if [ "$status" -eq 0 ]; then
+  exit 0
+fi
+
+# Ignore "already published" errors, but fail on everything else.
+if grep -qiE '(previously published|cannot publish over|EPUBLISHCONFLICT)' "$log_file"; then
+  echo "Publish skipped (already published)."
+  exit 0
+fi
+
+exit "$status"

.github/workflows/publish_npm.yml

@@ -10,6 +10,7 @@ env:
 jobs:
   release:
     runs-on: ubuntu-latest
+    environment: npm-publish
     permissions:
       contents: read
       id-token: write
@@ -38,15 +39,16 @@ jobs:
           unset NODE_AUTH_TOKEN
           if [ -n "${NPM_CONFIG_USERCONFIG:-}" ]; then
             rm -f "$NPM_CONFIG_USERCONFIG"
+            unset NPM_CONFIG_USERCONFIG
           fi
-          # run publish in every package, ignore failures (ie no publish required if the version is already published)
-          npx lerna exec --no-bail --stream --concurrency 1 -- "npm publish --tag \"$NPM_TAG\" --access public --provenance || true"
+          # run publish in every package; only ignore "already published" errors
+          npx lerna exec --no-bail --stream --concurrency 1 -- "bash \"$GITHUB_WORKSPACE/.github/scripts/npm-publish-ci.sh\""
 
       - name: Publish All Templates (granular token)
         if: ${{ vars.USE_NPM_TOKEN == 'true' }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
         run: |
           echo "Publishing templates to npm with tag $NPM_TAG via granular token..."
-          # run publish in every package, ignore failures (ie no publish required if the version is already published)
-          npx lerna exec --no-bail --stream --concurrency 1 -- "npm publish --tag \"$NPM_TAG\" --access public --provenance || true"
+          # run publish in every package; only ignore "already published" errors
+          npx lerna exec --no-bail --stream --concurrency 1 -- "bash \"$GITHUB_WORKSPACE/.github/scripts/npm-publish-ci.sh\""