ci(workflows): fix npm publish 404 error for scoped packages

Author: Douglasgomes027

.github/workflows/CD.yaml

@@ -320,6 +320,9 @@ jobs:
     if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/beta') && !contains(github.event.head_commit.message, 'chore(release):')
     needs: get-next-version
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # Required for OIDC
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -360,7 +363,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          #NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org:8443/
 
   build-docs:

.github/workflows/pr-build-deploy.yml

@@ -27,6 +27,9 @@ jobs:
     name: '🚀 Build and publish snapshot'
     needs: [validation, get-node-version]
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # Required for OIDC
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -38,6 +41,7 @@ jobs:
         with:
           node-version: ${{ needs.get-node-version.outputs.version }}
           registry-url: 'https://registry.npmjs.org'
+          scope: '@securityscorecard'
 
       - name: Setup Yarn
         run: |
@@ -116,8 +120,8 @@ jobs:
       - name: Publish to npm
         run: npm publish --tag pr-${{ github.event.number }}
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          #NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          #NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Comment on PR
         uses: actions/github-script@v7
@@ -154,12 +158,16 @@ jobs:
     if: github.event.action == 'closed'
     needs: get-node-version
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # Required for OIDC
+      contents: read
     steps:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: ${{ needs.get-node-version.outputs.version }}
           registry-url: 'https://registry.npmjs.org'
+          scope: '@securityscorecard'
 
       - name: Setup Yarn
         run: |
@@ -171,7 +179,7 @@ jobs:
           npm unpublish @securityscorecard/design-system@pr-${{ github.event.number }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          #NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         continue-on-error: true
 
       - name: Comment on PR