chore: auto-publish package to npm after release

[targos]

No description provided.

[targos]

Labeled "do not land" because we need to setup the npm token if this is accepted.

[mmarchini]

This would remove 2FA when we publish. Are we ok with that?

[targos]

npm now has automation tokens now, so we don't have to disable 2FA requirements on the package. AFAIU the only risk we would have is that someone with write access to this repo pushes something to steal the token?

[mmarchini]

We still drop 2FA for our "main" publish workflow (assuming the automation becomes the main workflow). It's not ideal IMO but probably low risk enough that we can try it?

[targos]

GitHub Actions now have environment protection rules and environment secrets: https://github.blog/changelog/2020-12-15-github-actions-environments-environment-protection-rules-and-environment-secrets-beta/
Maybe that can be used to protect an npm token and/or only allow a subset of collaborators to publish the package?

[targos]

I will reimplement the change differently if it's likely to land.

[targos]

Updated. We still need to setup an npm automation token before merging this. Who would be able to do that?

[targos]

The NPM_TOKEN secret is installed. Would you like to review again?