build: modfying publish action to use npm cli to include provenance in npm publish

.github/workflows/manual-publish.yml

@@ -41,6 +41,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - name: 'Setup Redis'
         if: ${{ inputs.workspace_path == 'packages/store/node-server-sdk-redis' }}
         run: |
@@ -80,5 +83,6 @@ jobs:
         uses: ./actions/publish
         with:
           workspace_name: ${{ env.WORKSPACE_NAME }}
+          workspace_path: ${{ inputs.workspace_path }}
           prerelease: ${{ inputs.prerelease }}
           dry_run: ${{ inputs.dry_run }}

.github/workflows/release-please.yml

@@ -40,6 +40,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/shared/common
         uses: ./actions/full-release
@@ -60,6 +63,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/shared/sdk-server
         uses: ./actions/full-release
@@ -80,6 +86,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/shared/sdk-server-edge
         uses: ./actions/full-release
@@ -100,6 +109,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/shared/akamai-edgeworker-sdk
         uses: ./actions/full-release
@@ -120,6 +132,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/cloudflare
         uses: ./actions/full-release
@@ -140,6 +155,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/server-node
         uses: ./actions/full-release
@@ -160,6 +178,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/vercel
         uses: ./actions/full-release
@@ -180,6 +201,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/akamai-base
         uses: ./actions/full-release
@@ -200,6 +224,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/akamai-edgekv
         uses: ./actions/full-release
@@ -220,6 +247,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - run: |
           sudo apt-get update
           sudo apt-get install redis-server
@@ -244,6 +274,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - run: |
           sudo docker run -d -p 8000:8000 amazon/dynamodb-local
       - id: release-common

actions/full-release/action.yml

@@ -34,6 +34,7 @@ runs:
     - uses: ./actions/publish
       with:
         workspace_name: ${{ env.WORKSPACE_NAME }}
+        workspace_path: ${{ inputs.workspace_path }}
         prerelease: false
         dry_run: false
     - uses: ./actions/publish-docs

actions/install-npm-version/action.yml

@@ -0,0 +1,16 @@
+name: Install npm version
+# Used to specify a version of npm that supports --provenance (for node installs < 18.X)
+description: Install the latest version of the npm CLI utility. 
+inputs:
+  npm_version:
+    description: 'The version of npm to install'
+    required: false
+    default: latest
+
+runs:
+  using: composite
+  steps:
+    - name: 'Install specified npm version'
+      shell: bash
+      run: |
+        npm install -g npm@${{ inputs.npm_version }}

actions/publish/action.yml

@@ -4,6 +4,9 @@ inputs:
   workspace_name:
     description: 'The workspace to publish'
     required: true
+  workspace_path:
+    description: 'Path to the workspace (for npm publish)'
+    required: true
   prerelease:
     description: 'Is this a prerelease. If so, then the latest tag will not be updated in npm.'
     required: true
@@ -21,5 +24,6 @@ runs:
         ./scripts/publish.sh
       env:
         WORKSPACE: ${{ inputs.workspace_name }}
+        WORKSPACE_PATH: ${{ inputs.workspace_path }}
         LD_RELEASE_IS_PRERELEASE: ${{ inputs.prerelease }}
         LD_RELEASE_IS_DRYRUN: ${{ inputs.dry_run }}

scripts/publish.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
+yarn workspace $WORKSPACE pack
 if $LD_RELEASE_IS_DRYRUN ; then
   # Dry run just pack the workspace.
   echo "Doing a dry run of publishing."
-  yarn workspace $WORKSPACE pack
 else
   if $LD_RELEASE_IS_PRERELEASE ; then
     echo "Publishing with prerelease tag."
-    yarn workspace $WORKSPACE npm publish --tag prerelease || { echo "npm publish failed" >&2; exit 1; }
+    npm publish --tag prerelease --provenance --access public "./$WORKSPACE_PATH/package.tgz" || { echo "npm publish failed" >&2; exit 1; }
   else
-    yarn workspace $WORKSPACE npm publish || { echo "npm publish failed" >&2; exit 1; }
+    npm publish --provenance --access public "./$WORKSPACE_PATH/package.tgz" || { echo "npm publish failed" >&2; exit 1; }
   fi
 fi