From 689712e1d2e38a73f3b8c3743bc265d970666b9d Mon Sep 17 00:00:00 2001
From: Frederik Prijck <frederik.prijck@auth0.com>
Date: Tue, 12 Dec 2023 11:10:08 +0100
Subject: [PATCH] Align release process by supporting npm provenance and tag
 and release-directory (#1216)

---
 .github/actions/get-release-notes/action.yml |  2 +-
 .github/actions/publish-package/action.yml   | 16 +++++++++++++++-
 .github/workflows/release.yml                |  4 +++-
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/.github/actions/get-release-notes/action.yml b/.github/actions/get-release-notes/action.yml
index 846aa45c9..c89b51a13 100644
--- a/.github/actions/get-release-notes/action.yml
+++ b/.github/actions/get-release-notes/action.yml
@@ -6,7 +6,7 @@ name: Return the release notes extracted from the PR body
 # TODO: Remove once the common repo is public.
 #
 inputs:
-  version :
+  version:
     required: true
   repo_name:
     required: false
diff --git a/.github/actions/publish-package/action.yml b/.github/actions/publish-package/action.yml
index 004459f9d..abbfcaaac 100644
--- a/.github/actions/publish-package/action.yml
+++ b/.github/actions/publish-package/action.yml
@@ -5,6 +5,10 @@ inputs:
     required: true
   npm-token:
     required: true
+  version:
+    required: true
+  release-directory:
+    default: './'
 
 runs:
   using: composite
@@ -27,6 +31,16 @@ runs:
 
     - name: Publish release to NPM
       shell: bash
-      run: npm publish
+      working-directory: ${{ inputs.release-directory }}
+      run: |
+        if [[ "${VERSION}" == *"beta"* ]]; then
+          TAG="beta"
+        elif [[ "${VERSION}" == *"alpha"* ]]; then
+          TAG="alpha"
+        else
+          TAG="latest"
+        fi
+        npm publish --provenance --tag $TAG
       env:
         NODE_AUTH_TOKEN: ${{ inputs.npm-token }}
+        VERSION: ${{ inputs.version }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6f121dbab..9b3db000b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,6 +8,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write # For publishing to npm using --provenance
 
 env:
   NODE_VERSION: 18
@@ -36,7 +37,7 @@ jobs:
         uses: ./.github/actions/get-prerelease
         with:
           version: ${{ steps.get_version.outputs.version }}
-      
+
       # Get the release notes
       # This will expose the release notes as env.RELEASE_NOTES
       - id: get_release_notes
@@ -62,6 +63,7 @@ jobs:
       - uses: ./.github/actions/publish-package
         with:
           node-version: ${{ env.NODE_VERSION }}
+          version: ${{ steps.get_version.outputs.version }}
           npm-token: ${{ secrets.NPM_TOKEN }}
 
       # Create a release for the tag