ci: migrate to npm trusted publishing (OIDC) and update publishing workflow

.github/workflows/check-new-package.yml

@@ -0,0 +1,93 @@
+name: Check New Theia Package
+
+on:
+  pull_request:
+    branches: [master]
+    types: [opened, synchronized, reopened]
+    paths:
+      - 'packages/*/package.json'
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  detect-new-packages:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+
+      - name: Detect if a new package was added
+        id: detect
+        run: |
+          git fetch origin ${{ github.base_ref }}
+          NEW_PACKAGES=$(git diff --name-only --diff-filter=A origin/${{ github.base_ref }}...HEAD | grep -E '^packages/[^/]+/package\.json$' || true)
+
+          if [ -z "$NEW_PACKAGES" ]; then
+            echo "new_package_found=false" >> $GITHUB_OUTPUT
+            echo "No new packages detected"
+          else
+            echo "new_package_found=true" >> $GITHUB_OUTPUT
+            PACKAGE_NAMES=$(echo "$NEW_PACKAGES" | sed 's|packages/\([^/]*\)/package\.json|\1|' | tr '\n' ',' | sed 's/,$//')
+            echo "package_names=$PACKAGE_NAMES" >> $GITHUB_OUTPUT
+            echo "New packages detected: $PACKAGE_NAMES"
+          fi
+
+      - name: Post or update checklist comment
+        if: steps.detect.outputs.new_package_found == 'true'
+        uses: actions/github-script@ffc2c79a5b2490bd33e0a41c1de74b877714d736 # v3.2.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const packageNames = '${{ steps.detect.outputs.package_names }}';
+            const packageList = packageNames.split(',').map(name => `\`${name}\``).join(', ');
+
+            const commentBody = "### New `@theia` Package(s) Detected
+            
+            This PR adds the following new package(s): ${packageList}
+
+            Please ensure the following checklist items are completed before merging:
+
+            - [ ] `package.json` contains all required fields (name, version, description, license, etc.) and scripts
+            - [ ] `README.md` was added (please align with the existing README structure, e.g. [README.md](https://github.com/eclipse-theia/theia/blob/master/packages/editor/README.md))
+            - [ ] Config files (`tsconfig.json`, `.eslintrc.js`) were added and align with the existing packages
+            - [ ] Folder structure follows Theia conventions (see [Code Organization](https://github.com/eclipse-theia/theia/blob/master/doc/code-organization.md))
+            - [ ] Package is added to the example applications (i.e. `browser`, `browser-only`, `electron`)
+            - [ ] New packages must be published manually by a Theia committer initially (see also [Release Process - Newly added Theia packages](https://github.com/eclipse-theia/theia/blob/master/doc/Publishing.md#212-newly-added-theia-packages---publish-initially-to-npm)).
+                  If you are not a committer or do not have enough time, please open a follow-up ticket with the label `toDoWithRelease` to inform the release team about the new package.
+            - [ ] If the package should also be part of the Theia IDE, please [open a ticket for the Theia IDE](https://github.com/eclipse-theia/theia-ide/issues/new?template=feature_request.md)
+                  and assign the `toDoWithRelease` (see for example: <https://github.com/eclipse-theia/theia-ide/issues/615>)"
+
+            const issue_number = context.issue.number;
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            const comments = await github.issues.listComments({
+              owner,
+              repo,
+              issue_number
+            });
+
+            const botComment = comments.data.find(comment =>
+              comment.user.type === 'Bot' &&
+              comment.body.includes('New `@theia` Package(s) Detected')
+            );
+
+            if (botComment) {
+              await github.issues.updateComment({
+                owner,
+                repo,
+                comment_id: botComment.id,
+                body: commentBody
+              });
+              console.log('Updated existing comment');
+            } else {
+              await github.issues.createComment({
+                owner,
+                repo,
+                issue_number,
+                body: commentBody
+              });
+              console.log('Created new comment');
+            }

.github/workflows/publish-api-doc-gh-pages.yml

@@ -53,16 +53,3 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./gh-pages
           force_orphan: true # will only keep latest commit on branch gh-pages
-
-      - name: Publish NPM
-        uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0
-        with:
-          timeout_minutes: 5
-          retry_wait_seconds: 30
-          max_attempts: 3
-          retry_on: error
-          command: npm run publish:next
-          on_retry_command: git reset --hard
-        env:
-          NPM_CONFIG_PROVENANCE: "true"
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }} # The variable name comes from here: https://github.com/actions/setup-node/blob/70b9252472eee7495c93bb1588261539c3c2b98d/src/authutil.ts#L48

.github/workflows/publish-release.yml → .github/workflows/publish-ci.yml

@@ -1,4 +1,4 @@
-name: Publish Release
+name: Publish packages to NPM
 
 permissions:
   id-token: write
@@ -9,17 +9,21 @@ on:
   workflow_dispatch:
     inputs:
       release_type:
-        description: 'Release type: "minor" increments the minor version (e.g., 1.53.0 → 1.54.0), "patch" increments the patch version (e.g., 1.54.0 → 1.54.1)'
+        description: 'Release type: "minor" increments the minor version (e.g., 1.53.0 → 1.54.0), "patch" increments the patch version (e.g., 1.54.0 → 1.54.1), "next" publishes a pre-release version (e.g., 1.55.0-next.17).'
         required: true
         type: choice
         options:
           - 'minor'
           - 'patch'
+          - 'next'
+        default: 'next'
       is_patch_to_previous:
-        description: 'Patch a previous release branch: Enable this to publish a patch to an older version branch (e.g., patching 1.53.x when 1.54.x is the latest). Must be used with release_type="patch". Leave disabled for publishing to the current latest version.'
+        description: 'Patch a previous release branch: Enable this to publish a patch to an older version branch (e.g., patching 1.53.x when 1.54.x is the latest). Must be used with release_type="patch". Leave disabled for publishing to the current latest or next version.'
         required: true
         type: boolean
         default: false
+  schedule:
+    - cron: "0 0 * * 1" # Publish next version (default) every monday at midnight
 
 jobs:
   publish:
@@ -64,26 +68,34 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # https://github.com/microsoft/vscode-ripgrep/issues/9
 
       - name: Publish to NPM (Latest)
-        if: ${{ !inputs.is_patch_to_previous }}
+        # We only publish minor or patch releases for the current version as latest, never for older patches or next versions.
+        if: ${{ (inputs.release_type == 'patch' || inputs.release_type == 'minor') && !inputs.is_patch_to_previous }}
         shell: bash
         run: |
           npm run publish:latest ${{ inputs.release_type }}
           npm run publish:check
         env:
           NPM_CONFIG_PROVENANCE: "true"
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
 
       - name: Publish to NPM (Patch - To Previous Version)
-        if: ${{ inputs.is_patch_to_previous }}
+        if: ${{ inputs.release_type == 'patch' && inputs.is_patch_to_previous }}
         shell: bash
         run: |
           npm run publish:patch ${{ inputs.release_type }}
           npm run publish:check
         env:
           NPM_CONFIG_PROVENANCE: "true"
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+
+      - name: Publish to NPM (Next)
+        if: ${{ inputs.release_type == 'next' }}
+        shell: bash
+        run: |
+          npm run publish:next
+        env:
+          NPM_CONFIG_PROVENANCE: "true"
 
       - name: Submit PR for package updates
+        if: ${{ inputs.release_type != 'next' }}
         shell: bash
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -142,4 +154,3 @@ jobs:
           else
             echo "No commits to push"
           fi
-