chore: add provenance and trusted publishers in release workflow (#1651)

Author: david-luna

.github/workflows/pre-release.yml

@@ -46,7 +46,7 @@ jobs:
           node-version-file: '.nvmrc'
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       # This prevent lerna command from throwing this error:
       # "Working tree has uncommitted changes, please commit or remove the following changes before continuing"

.github/workflows/release.yml

@@ -57,21 +57,13 @@ jobs:
           node-version-file: '.nvmrc'
 
       - name: Install dependencies
-        run: npm ci
-
-      # This prevent lerna command from throwing this error:
-      # "Working tree has uncommitted changes, please commit or remove the following changes before continuing"
-      - name: Ignore git uncommitted changes
-        run: |
-          git update-index --skip-worktree .npmrc
-
+        run: npm ci --ignore-scripts
+      
       - name: Publish the release
         env:
           DRY_RUN: "${{ inputs.dry-run }}"
           GITHUB_TOKEN: ${{ steps.get_token.outputs.token }}
-        run: |
-          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc
-          npm run ci:release
+        run: npm run ci:release
 
         # The permissions configuration for this can be found at
         # https://github.com/elastic/oblt-infra/blob/main/conf/resources/repos/apm-agent-rum-js/02-gcp-oidc-elastic-cdn.tf

packages/rum-angular/package.json

@@ -6,7 +6,8 @@
   "license": "MIT",
   "publishConfig": {
     "access": "public",
-    "directory": "dist"
+    "directory": "dist",
+    "provenance": true
   },
   "repository": {
     "type": "git",

packages/rum-core/package.json

@@ -8,7 +8,8 @@
   "source": "src/index.js",
   "sideEffects": false,
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "repository": {
     "type": "git",

packages/rum-react/package.json

@@ -16,7 +16,8 @@
     "node": ">=8.0.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "repository": {
     "type": "git",

packages/rum-vue/package.json

@@ -34,7 +34,8 @@
     "script": "node ../../dev-utils/run-script.js"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "repository": {
     "type": "git",

packages/rum/package.json

@@ -12,7 +12,8 @@
     "directory": "packages/rum"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "scripts": {
     "prepublishOnly": "npm run build",