feat: publish 1.2.x to public npm via trusted publishing

[kaviththiranga]

Backport of #771 to release-v1.2, so patches on this line publish to the public npm registry with provenance instead of GitHub Packages.

Why this is needed

v1.2.5 was tagged from this branch, which still runs the pre-cutover workflow — so all 23 packages are missing 1.2.5 on npm while latest sits at 1.2.4. Without this backport, every future 1.2.x patch repeats that and needs a manual backfill.

What changed

• .github/workflows/release.yml — split into build / publish-npm / retag-image, matching main. build installs and packs with no OIDC access; publish-npm holds id-token: write but does not check out the repo or install anything, so no dependency lifecycle script runs while the token is reachable. Adds a workspace: leak gate that fails the release before anything reaches the registry.
• 23 package.json files — dropped publishConfig.registry. This is load-bearing: npm reads publishConfig from inside the tarball and it beats the --registry flag (npm/cli#6400), so leaving it would push straight back to GitHub Packages.
• .npmrc — removed the GitHub Packages auth and scope lines.
• .changeset/config.json — access: restricted → public.
• README.md / CONTRIBUTING.md — install and release docs. Also drops @openchoreo/backstage-plugin-api from the install instructions; that package does not exist on npm or in this workspace.

Deliberately NOT bumping Yarn

main moved to Yarn 4.18 because yarn npm publish only learned OIDC in 4.10. This backport does not need that: publishing goes through yarn pack + npm publish, and 4.4.1 packs identically. Keeping the pinned toolchain avoids a 14-minor-version jump on a stable line.

Verified locally on this branch with Yarn 4.4.1:

tsc: 0    build:all: 0    topological order: 23 workspaces    pack: 23 tarballs
No workspace: leaks found.
spec: @openchoreo/backstage-plugin@1.2.5
publishConfig.registry present? false
rewritten deps: {"@openchoreo/backstage-design-system":"^1.2.5", ...}

No npm-side changes needed

Trusted publishers key on repository + workflow filename + environment — not branch — and all 24 are already configured for release.yml / npm-publish. The environment’s deployment rule is tag: v*, which already covers v1.2.6.

Dist-tag behaviour

Unchanged and already correct for a back-line: once 1.3.0 holds latest, a v1.2.6 tag publishes under release-1.2 rather than stealing latest. Before 1.3.0 ships it would take latest, which is also correct.

Note on 1.2.5

This PR does not publish 1.2.5 — that version was built by the old workflow and exists only on GitHub Packages. It can be backfilled separately with scripts/migrate-gh-packages-to-npmjs.js --since 1.2.5, or left as a GitHub-Packages-only version. Either way 1.2.6 onward publishes correctly from this branch.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9ec38542-ebbc-445b-8de9-2819bc2523ec

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!