Switch to OIDC for npm publishing

[matthewp]

Changes

• Updates the release.yml to use oidc.

Testing

N/A

Docs

N/A

[changeset-bot]

⚠️ No Changeset found

Latest commit: 63b7370

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[matthewp]

@HiDeoo @delucis updated

[HiDeoo]

Looks great to me now and matches what I've been doing so far 👍

I guess a remaining question could be whether this needs a changeset or not, is this a change we may want to inform users about?

[matthewp]

No, this is a change to how we publish packages, it shouldn't cause users to have to upgrade any packages.

[HiDeoo]

Yeah, was looking at what we did when we added provenance by curiosity, it was a patch to all packages.

Also looking at that old change, we could technically also remove the "provenance": true from all package.json if we wanted.

[delucis]

I’d be +1 on making it a patch for all packages: it would ensure securely published versions of everything go out now rather than only being published next time there’s a change to a package.

Users wouldn’t have to upgrade, but they could if they wanted.