ci: set up npm oidc

[2501babe]

foundation either has set up or is setting up the new npm publish flow so we can finally do the js release. this has been a thorn but not a priority since no one i talk to actually uses these libs and just handrolls

docs indicate that this is the thing to do to make this flow work, but i dont really know for sure, so if there is a known way to actually do this change please lmk

[joncinque]

I'm not too sure of the procedure at this point, so I'll defer to @lorisleiva on this -- what do we need to do on our side for publishing to work?

[lorisleiva]

Sorry I must of missed the GitHub notification! Yes this id-token: write is usually the only change you need to make Trusted Publishers work. That being said, depending on the publishing workflow, there are a few gotchas to bear in mind (e.g. Turbo monorepos swallowing env variables, changeset publishing not passing NPM_CONFIG_PROVENANCE=true, etc). All that to say that if the gods of NPM are on our side today, we should be okay. I'm happy to look into it if there are any issues though as I've been through many of these rabbit holes.

[2501babe]

tysm! i will try again and ping you if i see any issues