Fix publish permissions

.github/workflows/main.yml

@@ -11,18 +11,6 @@ on:
     branches:
       - main
       - dev
-  workflow_dispatch:
-    inputs:
-      dryRun:
-        description: 'Perform a dry run without publishing to npm'
-        required: true
-        default: true
-        type: boolean
-      npmTag:
-        description: 'Enforce a specific tag for creating a pre-release. If not provided, the tag will be determined automatically based on the version in package.json'
-        required: false
-        default: ''
-        type: string
 
 jobs:
   build:
@@ -62,20 +50,13 @@ jobs:
         run: |
           npm run test:ci:tags
 
-      - name: Setup
-        env:
-          NPM_DRY_RUN: ${{ github.event.inputs.dryRun }}
-          NPM_TAG: ${{ github.event.inputs.npmTag }}
-        # logs the ENV values and stores them back in GITHUB_ENV with proper defaults for the next step
-        run: |
-          ./.github/workflows/scripts/checkStatus.sh
-
-      - name: Publish
-        # dry-run can only be set to false if executed manually
-        uses: TypeFox/gh-publish-npm@fd8799b805ddfb79d82fbdfed8efdc9a1fad8f25 # v0.3.2
+      - name: Publish Dry-Run
+        # dry-run is always performed
+        uses: TypeFox/gh-publish-npm@4e114cef5985f2ab293188d9412ff63292bba217 # v0.3.3 / dev
         with:
-          dry-run: ${{ env.NPM_DRY_RUN }}
-          npm-tag: ${{ env.NPM_TAG }}
+          dry-run: true
+          verbose: true
+          npm-tag: 'next'
           npm-packages: |
             packages/client
             packages/vscode-ws-jsonrpc

.github/workflows/publish_oidc.yml

@@ -0,0 +1,94 @@
+name: Publish via OIDC
+
+permissions:
+  contents: read
+  id-token: write
+
+on:
+  push:
+    tags:
+      - '*-*.*.*'
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        description: 'Perform a dry run without publishing to npm'
+        required: true
+        default: true
+        type: boolean
+      npmTag:
+        description: 'Enforce a specific tag for version comparisons. If not provided, the default tag "latest" will be used.'
+        required: false
+        default: 'next'
+        type: string
+      verbose:
+        description: 'npm publish with verbose output'
+        required: true
+        default: false
+        type: boolean
+
+jobs:
+  publish_oidc:
+    runs-on: ubuntu-latest
+    environment: publish
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: mise-en-place
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+        with:
+          cache: false
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install
+        shell: bash
+        run: |
+          npm ci
+
+      - name: Versions Report & Setup
+        shell: bash
+        env:
+          NPM_DRY_RUN: ${{ github.event.inputs.dryRun }}
+          NPM_TAG: ${{ github.event.inputs.npmTag }}
+          NPM_VERBOSE: ${{ github.event.inputs.verbose }}
+        # logs the ENV values and stores them back in GITHUB_ENV with proper defaults for the next step
+        run: |
+          npm run report:versions
+          ./.github/workflows/scripts/checkStatus.sh
+
+      - name: Build
+        shell: bash
+        run: |
+          npm run build
+
+      - name: Lint & Format
+        shell: bash
+        run: |
+          npm run lint
+          npm run fmt
+
+      - name: Test
+        shell: bash
+        run: |
+          npm run test:ci:tags
+
+      - name: Publish
+        # dry-run can only be set to false if executed manually via workflow_dispatch
+        # tagged run only performs a dry-run for now
+        uses: TypeFox/gh-publish-npm@4e114cef5985f2ab293188d9412ff63292bba217 # v0.3.3 / dev
+        with:
+          dry-run: ${{ env.NPM_DRY_RUN }}
+          npm-tag: ${{ env.NPM_TAG }}
+          verbose: ${{ env.NPM_VERBOSE }}
+          npm-packages: |
+            packages/client
+            packages/vscode-ws-jsonrpc
+            packages/wrapper-react
+
+      - name: Check npm logs
+        if: always()
+        shell: bash
+        run: |
+          ./.github/workflows/scripts/checkNpmLogs.sh

.github/workflows/scripts/checkNpmLogs.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+latest_log=$(ls /home/runner/.npm/_logs/*debug*.log | sort | tail -n 1)
+if [ -f $latest_log ]; then
+  cat $latest_log
+fi

.github/workflows/scripts/checkStatus.sh

@@ -4,9 +4,14 @@ echo -e "\nReporting env variable values:"
 
 npmDryRun=${NPM_DRY_RUN:-true}
 npmTag=${NPM_TAG:-''}
-
-echo "NPM_DRY_RUN: ${npmDryRun}"
-echo "NPM_TAG: ${npmTag}"
+npmVerbose=${NPM_VERBOSE:-false}
 
 echo "NPM_DRY_RUN=${npmDryRun}" >> $GITHUB_ENV
 echo "NPM_TAG=${npmTag}" >> $GITHUB_ENV
+echo "NPM_VERBOSE=${npmVerbose}" >> $GITHUB_ENV
+
+echo -e "\nReporting environment variables:\n"
+
+echo "NPM_DRY_RUN: ${npmDryRun}"
+echo "NPM_TAG: ${npmTag}"
+echo "NPM_VERBOSE: ${npmVerbose}"