Make the `token` parameter optional

[chenjiahan]

First of all, thank you for creating and maintaining this action — it’s really useful and works great in our workflows.

Since npm now supports Trusted Publishing and no longer requires configuring NPM_TOKEN, could we make the token parameter optional?

[mcous]

Oh, this is an interesting npm feature that wasn't on my radar! Since this is a fairly new feature that isn't yet in the version of npm shipped with Node's current LTS, I think making token optional risks confusing folks who aren't yet set up on trusted publishing

Out of curiosity, is calling npm publish directly rather than relying on this action a possibility for you?

[chenjiahan]

Although this is a relatively new feature, I've noticed that many npm package authors are already adopting trusted publishing to reduce the risk of token leaks. My current workaround is to pass in an empty token, but it would be much better if the action could provide a more ideal way to handle this.

- name: Publish
  uses: JS-DevTools/npm-publish@v4
  with:
    token: empty

[mcous]

Yeah, I agree, trusted publishing via OIDC seems like a great feature that folks should use! I'll explore if there's a way to gracefully add it to this action

That being said, I think the most secure option would be to both use trusted publishing and avoid using a third-party publishing action like this one. For that reason, I'm softly trying to wind down maintenance on this action and push people to simply call npm publish directly.

Are there any features of this action that you rely on that couldn't be replaced by calling npm publish directly?

[chenjiahan]

avoid using a third-party publishing action like this one

Agreed. I will try to replacing this action with pnpm publish to see what is missing.

[mcous]

At least from my own usage of pnpm, I find that pnpm publish -r can replace this action in its entirety!