Migrate npm publish to OIDC Trusted Publishing via a reusable workflow (#57099)

[robhogan]

Summary:

Replaces the long-lived GHA_NPM_TOKEN automation token with npm
Trusted Publishing (OIDC) for every npm publish invoked from this
repo's GitHub Actions.

Why a reusable workflow:
npmjs.com Trusted Publishing accepts only ONE (org, repo,
workflow_filename, environment) tuple per package. Today, packages
are published from multiple workflow files:

• react-native from publish-release.yml + nightly.yml
• every react-native/* from nightly.yml + publish-bumped-packages.yml

A naive per-workflow OIDC migration would require two Trusted
Publisher entries per package, which npm doesn't support. Instead,
this diff funnels every npm publish through one new file —
.github/workflows/publish-npm.yml — invoked via workflow_call
from the existing top-level workflows. The OIDC job_workflow_ref
claim therefore always resolves to publish-npm.yml, so each
package needs exactly one Trusted Publisher entry pointing here.

What changes:

• New .github/workflows/publish-npm.yml: reusable workflow with a
  mode input. mode: react-native runs the full Android + iOS
  prebuilt + JS build path (used by release & nightly, publishes
  react-native and — in nightly mode — every react-native/*
  package via scripts/releases-ci/publish-npm.js). mode: monorepo-packages runs only the JS build and publishes the
  delta-bumped packages via
  scripts/releases-ci/publish-updated-packages.js (used by
  publish-bumped-packages.yml). Both jobs grant id-token: write so
  the npm CLI can mint the OIDC token for Trusted Publishing.

• .github/workflows/publish-release.yml: replace the
  build_npm_package job's inline build/publish steps with a
  uses: ./.github/workflows/publish-npm.yml call. The
  template-publish, rn-diff-purge, npm-verify, and Maven-verify
  steps move into a new post_publish follow-up job that
  needs: [build_npm_package]. Drops GHA_NPM_TOKEN from the env.

• .github/workflows/nightly.yml: same — build_npm_package now
  delegates to the reusable workflow. Drops GHA_NPM_TOKEN and the
  obsolete Verify NPM token precheck (Trusted Publishing has no
  pre-mintable token to validate; failures surface at npm publish
  time).

• .github/workflows/publish-bumped-packages.yml: shrinks to a thin
  trigger wrapper that calls the reusable workflow with
  mode: monorepo-packages.

• .github/workflows/create-release.yml: drop the obsolete Verify NPM token step.

• .github/actions/build-npm-package: drop the gha-npm-token
  input and the Set npm credentials step that wrote _authToken.
  Pass registry-url: https://registry.npmjs.org to setup-node so
  actions/setup-node@v6 writes a .npmrc configured to consume
  the OIDC token at publish time.

• .github/actions/setup-node: thread a new registry-url input
  through to actions/setup-node@v6.

The publish scripts themselves (scripts/releases-ci/publish-npm.js,
scripts/releases-ci/publish-updated-packages.js,
scripts/releases/utils/npm-utils.js) are unchanged: they shell out
to plain npm publish, which performs the OIDC exchange transparently
when it sees a GitHub Actions OIDC environment and a Trusted Publisher
configured for the package on npmjs.com.

Note: this diff only changes the workflow definitions. Each package
on npmjs.com must additionally be configured with a Trusted Publisher
pointing at:

• org: facebook
• repo: react-native
• workflow filename: publish-npm.yml
• environment: (blank — none configured)

The npm CLI's OIDC exchange returns 404 until that registry-side
config is in place. Trusted Publisher entries are additive on
npmjs.com (don't enable "Require Trusted Publishing" yet) so the
existing token-based flow keeps working through the cutover. See the
stack landing notes for the full package list and UI steps.

Backport: this also needs picking back to *-stable branches before
"Require Trusted Publishing" is enabled on any package, since
GitHub Actions runs the workflow file from the ref that triggers it.

Changelog:
[Internal]

Reviewed By: cortinico, cipolleschi

Differential Revision: D107805971

[meta-codesync]

@robhogan has exported this pull request. If you are a Meta employee, you can view the originating Diff in D107805971.

[cortinico]

Review automatically exported from Phabricator review in Meta.

[meta-codesync]

This pull request has been merged in 8bcfb3b.

[react-native-bot]

This pull request was successfully merged by @robhogan in 8bcfb3b

^{When will my fix make it into a release? | How to file a pick request?}