Support trusted publishing with OIDC

.github/workflows/publish.yml

@@ -0,0 +1,43 @@
+name: Publish Package
+
+on:
+  push:
+    tags:
+      - "*"
+
+permissions:
+  id-token: write # Required for OIDC
+
+jobs:
+  publish:
+    if: github.repository == 'yext/search-core'
+    runs-on: ubuntu-latest
+    environment: Release
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: master
+
+      - name: Set node version to 20.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          registry-url: https://registry.npmjs.org/
+          cache: "npm"
+
+      - name: Install deps
+        run: npm i --ignore-scripts
+
+      - name: Update npm
+        # npm version npm 11.5.1 or later needed for Trusted Publishing
+        run: npm install -g npm@latest
+
+      - name: Verify package version and get npm tag
+        id: get_npm_tag
+        run: |
+          TAG=$(npm run ci-verify-publish ${{ github.ref_name }} | tail -n 1)
+          echo "npm_tag=$TAG" >> $GITHUB_OUTPUT
+
+      - name: Publish
+        run: npm publish --access public --tag ${{ steps.get_npm_tag.outputs.npm_tag }}