Enable npm trusted publishing on 0.85 (#57712)

* [LOCAL] Set stagingProfileId to com.facebook

* Enable npm trusted publishing on 0.85

* Complete trusted publishing repository metadata

* Fix trusted publishing Flow types

* Use shared repository metadata type

---------

Co-authored-by: Nicola Corti <ncor@meta.com>

Author: cipolleschi

.github/actions/build-npm-package/action.yml

@@ -4,10 +4,6 @@ inputs:
   release-type:
     required: true
     description: The type of release we are building. It could be nightly, release or dry-run
-  gha-npm-token:
-    required: false
-    description: The GHA npm token, required only to publish to npm
-    default: ''
   gradle-cache-encryption-key:
     description: The encryption key needed to store the Gradle Configuration cache
 
@@ -38,6 +34,9 @@ runs:
         cache-encryption-key: ${{ inputs.gradle-cache-encryption-key }}
     - name: Setup node.js
       uses: ./.github/actions/setup-node
+      with:
+        node-version: '24'
+        registry-url: 'https://registry.npmjs.org'
     - name: Install dependencies
       uses: ./.github/actions/yarn-install
     - name: Build packages
@@ -46,12 +45,9 @@ runs:
     - name: Build types
       shell: bash
       run: yarn build-types --skip-snapshot
-    # Continue with publish steps
-    - name: Set npm credentials
-      if: ${{ inputs.release-type == 'release' ||
-        inputs.release-type == 'nightly' }}
-      shell: bash
-      run: echo "//registry.npmjs.org/:_authToken=${{ inputs.gha-npm-token }}" > ~/.npmrc
+    # `npm publish` below authenticates via npm Trusted Publishing (OIDC).
+    # The caller (the `publish-npm.yml` workflow) MUST grant `id-token: write`;
+    # this composite action runs inside that job.
     - name: Publish NPM
       shell: bash
       run: |

.github/actions/setup-node/action.yml

@@ -5,11 +5,19 @@ inputs:
     description: 'The node.js version to use'
     required: false
     default: '22.14.0'
+  registry-url:
+    description: |
+      Optional npm registry URL passed through to actions/setup-node. Set on
+      jobs that publish to npm so setup-node writes a `.npmrc` configured to
+      pick up the OIDC-minted token from npm Trusted Publishing.
+    required: false
+    default: ''
 runs:
-  using: "composite"
+  using: 'composite'
   steps:
     - name: Setup node.js
       uses: actions/setup-node@v6
       with:
         node-version: ${{ inputs.node-version }}
         cache: yarn
+        registry-url: ${{ inputs.registry-url }}

.github/workflows/bump-podfile-lock.yml

@@ -5,7 +5,7 @@ on:
 
 jobs:
   bump-podfile-lock:
-    runs-on: macos-latest
+    runs-on: macos-15
     steps:
       - name: Checkout
         uses: actions/checkout@v6