What is the current behavior?

• Publishing to npm is failing due to the changes to move to Trusted Publishers, since it seems that they still don't support reusable workflows, as mentioned here
• The action to which we grant permissions on npm needs to follow a strict path location .github/workflows/ in your repository.
• Permissions mismatches running GitHub actions
• Used stenciljs/.github/actions/publish-npm@main

GitHub Issue Number: N/A

What is the new behavior?

• The repo now owns an OIDC-enabled publish-npm.yml, release-dev.yml, release-production.yml, and release-orchestrator.yml, so releases no longer reuse stenciljs/.github/actions/publish-npm@main
• Fixed permissions mismatch by applying the orchestrator method for npm publish:

release-orchestrator.yml (contents: read, id-token: write)
├─→ release-dev.yml (contents: read, id-token: write)
│ └─→ publish-npm.yml (contents: read, id-token: write) ✅
└─→ release-production.yml (contents: read, id-token: write)
└─→ publish-npm.yml (contents: read, id-token: write) ✅

Documentation

N/A

Does this introduce a breaking change?

• Yes
• No

Testing

• Run pipelines after merge

Other information

• The workflow release-orchestrator.yml needs to be the one set up in the npm package settings for the Trusted Publishers