gha: update publish-to-npm (using OIDC now)

[clee]

Should fix DEVPROD-3689, as I've already set up the OIDC link on the NPMJS side.

[netlify]

✅ Deploy Preview for docs-extensions-and-macros ready!

Name	Link
🔨 Latest commit	9d12f3f
🔍 Latest deploy log	https://app.netlify.com/projects/docs-extensions-and-macros/deploys/6930830843a15b00086707f0
😎 Deploy Preview	https://deploy-preview-158--docs-extensions-and-macros.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

📝 Walkthrough

Walkthrough

The GitHub Actions workflow for publishing to npm has been updated to use newer action versions (checkout@v5 and setup-node@v5) and modified to remove AWS Secrets Manager retrieval and explicit npm token passing to the publish step. This change aligns with moving away from classic npm tokens toward trusted publishing mechanisms, addressing security token lifecycle requirements.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

• Single file modification with straightforward version upgrades and removal of legacy secret-handling logic
• No complex interdependencies or functional logic changes to evaluate
• Changes consist of action version updates and deletion of AWS Secrets Manager integration and token input

Pre-merge checks and finishing touches

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly indicates the main change: updating the publish-to-npm workflow to use OIDC authentication instead of token-based authentication.
Description check	✅ Passed	The description is related to the changeset, referencing the Jira issue DEVPROD-3689 and mentioning that OIDC has been set up on the npmjs side.
Linked Issues check	✅ Passed	The PR successfully addresses DEVPROD-3689 by migrating from classic token authentication to OIDC. The workflow changes remove AWS Secrets Manager retrieval and token passing, implementing trusted publishing as required.
Out of Scope Changes check	✅ Passed	All changes are in scope: the GitHub Actions workflow modifications directly support the OIDC migration objective from DEVPROD-3689. No unrelated alterations are present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR updates the npm publish workflow to use OIDC authentication instead of token-based authentication, addressing DEVPROD-3689. The changes modernize the GitHub Actions versions and remove the explicit token parameter, relying on OIDC credentials configured externally.

Key Changes:

• Updated GitHub Actions from v4 to v5 for checkout and setup-node
• Removed explicit NPM_TOKEN parameter from npm-publish action to use OIDC authentication

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/publish-to-npm.yaml (1)

14-17: Remove unnecessary AWS credentials configuration from publish job.

The AWS credentials configuration in the publish job appears redundant now that npm authentication has migrated to OIDC. This AWS role assumption was previously needed to retrieve the npm token from AWS Secrets Manager, but that step has been removed. Consider removing lines 14-17 to streamline the workflow and reduce unnecessary AWS API calls.

Note: The AWS configuration in the dispatch job (lines 36-39) is still needed to retrieve the GitHub Actions bot token.

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ vars.RP_AWS_CRED_REGION }}
          role-to-assume: arn:aws:iam::${{ secrets.RP_AWS_CRED_ACCOUNT_ID }}:role/${{ vars.RP_AWS_CRED_BASE_ROLE_NAME }}${{ github.event.repository.name }}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between e83c5b0 and 7052878.

📒 Files selected for processing (1)

• .github/workflows/publish-to-npm.yaml (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: test-property-extractor (3.11)
• GitHub Check: test-property-extractor (3.9)

[JakeSCahill]

Thanks!