Switch to OIDC for npm publish tokens

[BYK]

Due to recent supply-chain attacks, legacy NPM tokens are getting retired early November. We rely on the legacy automation tokens which will get affected (removed).

The next logical step seems like adopting OIDC for this too.

[BYK]

The OIDC setup seems to be package-level, meaning we need to go through each package we have and set it up. This is not feasible, nor it covers any new packages we may want to publish. Asked GitHub for an org-level option and will chart a new path if they won't be able to provide this.

[BYK]

Chatted with NPM/GitHub folks -- org-level OIDC support is definitely on the roadmap but we have a few more months before its ready. This means we'll have to rotate NPM keys every 90 days a few times.

I've created a new key and added this to the production environment as a secret with the name NPM_TOKEN. I'll make a PR to use the production environment for publish actions which will then pick up the new key and we can do a test run. I tested Spotlight with the same type of key and it worked so I'm quite hopeful that it will work without issues on the first try.

[BYK]

If we cannot implement this by February 11, 2026 we need to rotate the NPM token we created.

[isaacs]

See also: Publishing More Securely on npm: Guidance from the OpenJS Security Collaboration Space