Align release process by supporting npm provenance and tag and releas…

…e-directory (#1216)

.github/actions/get-release-notes/action.yml

@@ -6,7 +6,7 @@ name: Return the release notes extracted from the PR body
 # TODO: Remove once the common repo is public.
 #
 inputs:
-  version :
+  version:
     required: true
   repo_name:
     required: false

.github/actions/publish-package/action.yml

@@ -5,6 +5,10 @@ inputs:
     required: true
   npm-token:
     required: true
+  version:
+    required: true
+  release-directory:
+    default: './'
 
 runs:
   using: composite
@@ -27,6 +31,16 @@ runs:
 
     - name: Publish release to NPM
       shell: bash
-      run: npm publish
+      working-directory: ${{ inputs.release-directory }}
+      run: |
+        if [[ "${VERSION}" == *"beta"* ]]; then
+          TAG="beta"
+        elif [[ "${VERSION}" == *"alpha"* ]]; then
+          TAG="alpha"
+        else
+          TAG="latest"
+        fi
+        npm publish --provenance --tag $TAG
       env:
         NODE_AUTH_TOKEN: ${{ inputs.npm-token }}
+        VERSION: ${{ inputs.version }}

.github/workflows/release.yml

@@ -8,6 +8,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write # For publishing to npm using --provenance
 
 env:
   NODE_VERSION: 18
@@ -36,7 +37,7 @@ jobs:
         uses: ./.github/actions/get-prerelease
         with:
           version: ${{ steps.get_version.outputs.version }}
-      
+
       # Get the release notes
       # This will expose the release notes as env.RELEASE_NOTES
       - id: get_release_notes
@@ -62,6 +63,7 @@ jobs:
       - uses: ./.github/actions/publish-package
         with:
           node-version: ${{ env.NODE_VERSION }}
+          version: ${{ steps.get_version.outputs.version }}
           npm-token: ${{ secrets.NPM_TOKEN }}
 
       # Create a release for the tag