Use Case

Replace token based publishing with trusted publishing
this will require updating to npm@11 from our current npm@9

As a... npm package publisher
I want... to use trusted publishing
So that... my users know I created the package on a trusted host

User Experience

• npm should now show a green checkmark next to all our packages and link to provenance

Risks/Unknowns

• npm trusted publishing is supposedly one-way, as in, once we release a package with it enabled we cannot release without it, can we confirm that?
• Is there any change to the way we get our secret for publishing? (shouldn't be, its unrelated)
• Is the ownership work a strict prerequisite to picking this up?

Acceptance Criteria

Implementation Requirements

• Follow the directions given by npm: https://docs.npmjs.com/trusted-publishers
• We want to do this for devtools-shared and Compass, VScode, https://github.com/mongodb-js/electron-wix-msi 

Testing Requirements

• None, the release succeeding is the test (plus manually checking for the npm checkmark)

References