Daniel Sogl 9818f74831 ci: publish to npm via trusted publishing (OIDC) ...

npm validates the OIDC claim of the entry-point workflow, not the one that
runs `npm publish`. Calling publish.yml via workflow_call meant the trust
check could never match, so the publish job moves inline into
release-please.yml and publish.yml is removed.

setup-node with Node 22 ships npm 10.x; trusted publishing needs >= 11.5.1,
hence the explicit npm upgrade before publishing.

NPM_TOKEN stays as a fallback for packages that have no trusted publisher
yet — a brand new plugin cannot get one until it exists on npm. OIDC takes
precedence wherever a config is present.

Adds scripts/tasks/trust-packages.sh to configure the trusted publisher for
all 258 packages; npm has no multi-package call and `npm trust` requires
interactive 2FA, so it runs locally, in parallel, and is resumable.

2026-07-27 21:18:10 +02:00

..

build-esm.ts

fix: restore v9 plugin exports (#5144)

2026-04-15 11:00:56 +02:00

build-ngx.ts

feat(core): use angular ivy (#4369)

2022-10-15 18:12:20 +02:00

plugin-create.ts

refactor: replace build dependencies with native Node.js APIs

2026-03-21 15:16:55 -07:00

publish.ts

fix: exit with non-zero code when npm publish fails

2026-03-21 16:27:56 -07:00

trust-packages.sh

ci: publish to npm via trusted publishing (OIDC)

2026-07-27 21:18:10 +02:00