From 63610fe6c7b82be34de0f66f721e8141d061ca75 Mon Sep 17 00:00:00 2001
From: Florian Hammerschmidt <florianh89@gmail.com>
Date: Mon, 10 Aug 2026 16:24:55 +0200
Subject: [PATCH] Activate NPM trusted publishing

---
 .github/workflows/ci.yml | 64 ++++++++++++++++++++++++++++++----------
 1 file changed, 48 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1e36e6486..cdc44e805 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -316,21 +316,15 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/')
         run: npx vsce publish --pat ${{ secrets.MARKETPLACE_TOKEN }} ${{ steps.tag_name.outputs.tag }} --no-git-tag-version
 
-      - name: Publish LSP as pre-release to NPM
-        if: github.ref == 'refs/heads/master'
+      - name: Package LSP for NPM
+        if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
         working-directory: server
         run: |
-          npm version preminor --preid next-$(git rev-parse --short HEAD)
-          npm publish --access public --tag next
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Publish LSP to NPM
-        if: startsWith(github.ref, 'refs/tags/')
-        working-directory: server
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          if [[ "$GITHUB_REF" == "refs/heads/master" ]]; then
+            npm version preminor --preid next-$(git rev-parse --short HEAD)
+          fi
+          mkdir -p ../npm-packages
+          npm pack --pack-destination ../npm-packages
 
       - name: Build @rescript/tools package
         working-directory: tools
@@ -338,9 +332,47 @@ jobs:
           npm ci
           npm run build
 
-      - name: Publish @rescript/tools package
+      - name: Package @rescript/tools for NPM
         if: ${{ startsWith(github.event.head_commit.message, 'publish tools') && (github.ref == 'refs/heads/master') }}
         working-directory: tools
-        run: npm publish --access public
+        run: npm pack --pack-destination ../npm-packages
+
+      - name: Upload NPM packages
+        if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
+        uses: actions/upload-artifact@v4
+        with:
+          name: npm-packages
+          path: npm-packages/*.tgz
+          retention-days: 1
+
+  publish-npm:
+    name: Publish NPM packages
+    needs: package
+    if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Use Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false
+
+      - name: Download NPM packages
+        uses: actions/download-artifact@v4
+        with:
+          name: npm-packages
+          path: packages
+
+      - name: Publish LSP to NPM
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TAG: ${{ github.ref == 'refs/heads/master' && 'next' || 'latest' }}
+        run: npm publish packages/rescript-language-server-*.tgz --access public --tag "$NPM_TAG"
+
+      - name: Publish @rescript/tools package
+        if: ${{ startsWith(github.event.head_commit.message, 'publish tools') && (github.ref == 'refs/heads/master') }}
+        run: npm publish packages/rescript-tools-*.tgz --access public