chore: migrate npm publish workflows to use npm trust oidc action of qvac-devops

.github/workflows/approval-worker.yml

@@ -48,7 +48,7 @@ jobs:
       pull-requests: write
       statuses: write
       issues: write
-    uses: tetherto/qvac-devops/.github/workflows/approval-check-worker.yml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/approval-check-worker.yml@v1.1.8
     secrets:
       pat_token: ${{ secrets.PAT_TOKEN }}
     with:

.github/workflows/on-merge-lib-infer-diffusion.yml

@@ -163,7 +163,7 @@ jobs:
 
       - name: Publish to GitHub Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.8
         with:
           secret-token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ inputs.tag || needs.publish-logic.outputs.gpr_tag }}
@@ -185,6 +185,7 @@ jobs:
     permissions:
       contents: write
       packages: write
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
@@ -212,7 +213,7 @@ jobs:
 
       - name: Publish to NPM Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm-oidc@v1.1.8
         with:
           secret-token: ${{ secrets.NPM_TOKEN }}
           tag: "latest"

.github/workflows/on-merge-ocr-onnx.yml

@@ -150,7 +150,7 @@ jobs:
 
       - name: Publish to GitHub Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.8
         with:
           secret-token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ inputs.tag || needs.publish-logic.outputs.gpr_tag }}
@@ -172,6 +172,7 @@ jobs:
     permissions:
       contents: write
       packages: write
+      id-token: write
     env:
       PKG_DIR: packages/ocr-onnx
     steps:
@@ -188,7 +189,7 @@ jobs:
 
       - name: Publish to NPM Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm-oidc@v1.1.8
         with:
           secret-token: ${{ secrets.NPM_TOKEN }}
           tag: "latest"

.github/workflows/on-merge-qvac-lib-decoder-audio.yml

@@ -152,7 +152,7 @@ jobs:
           fetch-depth: 0
 
       - name: Publish to GitHub Packages
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.8
         with:
           secret-token: ${{ secrets.GITHUB_TOKEN }}
           pat-token: ${{ secrets.PAT_TOKEN }}
@@ -174,13 +174,14 @@ jobs:
     permissions:
       contents: write
       packages: write
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
 
       - name: Publish to NPM Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm-oidc@v1.1.8
         with:
           secret-token: ${{ secrets.NPM_TOKEN }}
           tag: "latest"

.github/workflows/on-merge-qvac-lib-infer-llamacpp-embed.yml

@@ -144,7 +144,7 @@ jobs:
 
       - name: Publish to GitHub Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.8
         with:
           secret-token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ inputs.tag || needs.publish-logic.outputs.gpr_tag }}
@@ -166,6 +166,7 @@ jobs:
     permissions:
       contents: write
       packages: write
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
@@ -180,7 +181,7 @@ jobs:
 
       - name: Publish to NPM Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm-oidc@v1.1.8
         with:
           secret-token: ${{ secrets.NPM_TOKEN }}
           tag: "latest"

.github/workflows/on-merge-qvac-lib-infer-llamacpp-llm.yml

@@ -164,7 +164,7 @@ jobs:
 
       - name: Publish to GitHub Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.8
         with:
           secret-token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ inputs.tag || needs.publish-logic.outputs.gpr_tag }}
@@ -186,6 +186,7 @@ jobs:
     permissions:
       contents: write
       packages: write
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
@@ -213,7 +214,7 @@ jobs:
 
       - name: Publish to NPM Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm-oidc@v1.1.8
         with:
           secret-token: ${{ secrets.NPM_TOKEN }}
           tag: "latest"

.github/workflows/on-merge-qvac-lib-infer-onnx-tts.yml

@@ -142,7 +142,7 @@ jobs:
 
       - name: Publish to GitHub Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.8
         with:
           secret-token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ inputs.tag || needs.publish-logic.outputs.gpr_tag }}
@@ -164,6 +164,7 @@ jobs:
     permissions:
       contents: write
       packages: write
+      id-token: write
     env:
       WORKDIR: packages/qvac-lib-infer-onnx-tts
     steps:
@@ -178,7 +179,7 @@ jobs:
 
       - name: Publish to NPM Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm-oidc@v1.1.8
         with:
           secret-token: ${{ secrets.NPM_TOKEN }}
           tag: "latest"

.github/workflows/on-merge-qvac-lib-infer-onnx.yml

@@ -144,7 +144,7 @@ jobs:
 
       - name: Publish to GitHub Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.8
         with:
           secret-token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ inputs.tag || needs.publish-logic.outputs.gpr_tag }}
@@ -165,6 +165,7 @@ jobs:
     permissions:
       contents: write
       packages: write
+      id-token: write
     env:
       PKG_DIR: packages/qvac-lib-infer-onnx
     steps:
@@ -181,7 +182,7 @@ jobs:
 
       - name: Publish to NPM Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm-oidc@v1.1.8
         with:
           secret-token: ${{ secrets.NPM_TOKEN }}
           tag: "latest"

.github/workflows/on-merge-qvac-lib-infer-parakeet.yml

@@ -157,7 +157,7 @@ jobs:
 
       - name: Publish to GitHub Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.8
         with:
           secret-token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ inputs.tag || needs.publish-logic.outputs.gpr_tag }}
@@ -194,6 +194,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
@@ -206,7 +207,7 @@ jobs:
 
       - name: Publish to NPM Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm-oidc@v1.1.8
         with:
           secret-token: ${{ secrets.NPM_TOKEN }}
           tag: "latest"

.github/workflows/on-merge-qvac-lib-infer-whispercpp.yml

@@ -160,7 +160,7 @@ jobs:
 
       - name: Publish to GitHub Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-gpr@v1.1.8
         with:
           secret-token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.tag) || needs.publish-logic.outputs.gpr_tag }}
@@ -200,6 +200,7 @@ jobs:
     permissions:
       contents: write
       packages: write
+      id-token: write
     env:
       WORKDIR: packages/qvac-lib-infer-whispercpp
     steps:
@@ -216,7 +217,7 @@ jobs:
 
       - name: Publish to NPM Package Registry
         id: publish
-        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/publish-library-to-npm-oidc@v1.1.8
         with:
           secret-token: ${{ secrets.NPM_TOKEN }}
           tag: "latest"

.github/workflows/on-pr-close-lib-infer-diffusion.yml

@@ -52,7 +52,7 @@ jobs:
   delete-npm-versions-trigger:
     permissions:
       packages: write
-    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.8
     with:
       version: ${{ inputs.version }}
       pr-number: ${{ inputs.pr-number }}

.github/workflows/on-pr-close-ocr-onnx.yml

@@ -49,7 +49,7 @@ jobs:
   delete-npm-versions-trigger:
     permissions:
       packages: write
-    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.8
     with:
       version: ${{ inputs.version }}
       pr-number: ${{ inputs.pr-number }}

.github/workflows/on-pr-close-qvac-lib-decoder-audio.yml

@@ -57,7 +57,7 @@ jobs:
   delete-npm-versions-trigger:
     permissions:
       packages: write
-    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.8
     with:
       version: ${{ inputs.version }}
       pr-number: ${{ github.event_name == 'pull_request' && github.event.pull_request.number || inputs.pr-number }}

.github/workflows/on-pr-close-qvac-lib-infer-llamacpp-embed.yml

@@ -56,7 +56,7 @@ jobs:
   delete-npm-versions-trigger:
     permissions:
       packages: write
-    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.8
     with:
       version: ${{ inputs.version }}
       pr-number: ${{ github.event_name == 'pull_request' && github.event.pull_request.number || inputs.pr-number }}

.github/workflows/on-pr-close-qvac-lib-infer-llamacpp-llm.yml

@@ -52,7 +52,7 @@ jobs:
   delete-npm-versions-trigger:
     permissions:
       packages: write
-    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.8
     with:
       version: ${{ inputs.version }}
       pr-number: ${{ inputs.pr-number }}

.github/workflows/on-pr-close-qvac-lib-infer-nmtcpp.yml

@@ -47,7 +47,7 @@ jobs:
   delete-npm-versions-trigger:
     permissions:
       packages: write
-    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.8
     with:
       version: ${{ inputs.version }}
       pr-number: ${{ inputs.pr-number }}

.github/workflows/on-pr-close-qvac-lib-infer-onnx-tts.yml

@@ -57,7 +57,7 @@ jobs:
   delete-npm-versions-trigger:
     permissions:
       packages: write
-    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.8
     with:
       version: ${{ inputs.version }}
       pr-number: ${{ github.event_name == 'pull_request' && github.event.pull_request.number || inputs.pr-number }}

.github/workflows/on-pr-close-qvac-lib-infer-onnx.yml

@@ -49,7 +49,7 @@ jobs:
   delete-npm-versions-trigger:
     permissions:
       packages: write
-    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.8
     with:
       version: ${{ inputs.version }}
       pr-number: ${{ inputs.pr-number }}

.github/workflows/on-pr-close-qvac-lib-infer-parakeet.yml

@@ -57,7 +57,7 @@ jobs:
   delete-npm-versions-trigger:
     permissions:
       packages: write
-    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.8
     with:
       version: ${{ inputs.version }}
       pr-number: ${{ github.event_name == 'pull_request' && github.event.pull_request.number || inputs.pr-number }}

.github/workflows/on-pr-close-qvac-lib-infer-whispercpp.yml

@@ -57,7 +57,7 @@ jobs:
   delete-npm-versions-trigger:
     permissions:
       packages: write
-    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/public-delete-npm-versions.yml@v1.1.8
     with:
       version: ${{ inputs.version }}
       pr-number: ${{ github.event_name == 'pull_request' && github.event.pull_request.number || inputs.pr-number }}

.github/workflows/on-pr-lib-infer-diffusion.yml

@@ -51,7 +51,7 @@ jobs:
     environment: release
     steps:
       - name: Run Sanity checks
-        uses: tetherto/qvac-devops/.github/actions/sanity-checks@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/sanity-checks@v1.1.8
         with:
           secret-token: ${{ secrets.GITHUB_TOKEN }}
           npm-token: ${{ secrets.NPM_TOKEN }}
@@ -71,7 +71,7 @@ jobs:
 
   cpp-lint:
     if: needs.authorize.outputs.allowed == 'true'
-    uses: tetherto/qvac-devops/.github/workflows/cpp-lint.yaml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/cpp-lint.yaml@v1.1.8
     needs: authorize
     secrets: inherit
     with:
@@ -158,7 +158,7 @@ jobs:
         ts-checks,
       ]
     if: always()
-    uses: tetherto/qvac-devops/.github/workflows/public-pr.yml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/public-pr.yml@v1.1.8
     permissions:
       contents: read
       pull-requests: write

.github/workflows/on-pr-ocr-onnx.yml

@@ -106,7 +106,7 @@ jobs:
 
       - name: Verify that yaml files are formatted
         id: yamlfmt
-        uses: tetherto/qvac-devops/.github/actions/yamlfmt@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/yamlfmt@v1.1.8
         continue-on-error: true
 
       - name: Check for disallowed dependencies
@@ -122,7 +122,7 @@ jobs:
       - name: Run JavaScript tests
         id: run_js_tests
         continue-on-error: true
-        uses: tetherto/qvac-devops/.github/actions/run-lint-and-unit-tests@v1.1.7
+        uses: tetherto/qvac-devops/.github/actions/run-lint-and-unit-tests@v1.1.8
         with:
           npm-token: ${{ secrets.NPM_TOKEN }}
           gpr-token: ${{ secrets.GITHUB_TOKEN }}
@@ -161,7 +161,7 @@ jobs:
   cpp-lint:
     needs: [authorize, changes]
     if: needs.authorize.outputs.allowed == 'true' || github.event_name == 'workflow_dispatch'
-    uses: tetherto/qvac-devops/.github/workflows/cpp-lint.yaml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/cpp-lint.yaml@v1.1.8
     secrets: inherit
     with:
       sha: ${{ github.event.pull_request.base.sha || github.sha }}
@@ -224,7 +224,7 @@ jobs:
   merge-guard:
     needs: [authorize, changes, sanity-checks, prebuild, run-integration-tests, run-mobile-integration-tests]
     if: always() && (needs.changes.outputs.pkg == 'true' || github.event_name == 'workflow_dispatch')
-    uses: tetherto/qvac-devops/.github/workflows/public-pr.yml@v1.1.7
+    uses: tetherto/qvac-devops/.github/workflows/public-pr.yml@v1.1.8
     with:
       sanity-checks-status: ${{ needs.sanity-checks.result == 'success' }}
       build-status: ${{ needs.prebuild.result == 'success' }}