feat: support token-based package publishing on npm (oidc)

command-snapshot.json

@@ -153,6 +153,7 @@
       "json",
       "npmaccess",
       "npmtag",
+      "oidc",
       "prerelease",
       "sign",
       "verify"

messages/npm.package.release.md

@@ -26,6 +26,10 @@ run yarn install and build on repository
 
 given a github tag, release the version specified in the package.json as is. Useful when you've already done a release and only need npm publish features
 
+# flags.oidc.summary
+
+enable OpenID Connect (OIDC) authentication for secure, token-based package publishing on npm
+
 # flags.prerelease.summary
 
 determine the next version as <version>-<prerelease>.0 if version is not manually set

src/commands/npm/package/release.ts

@@ -65,6 +65,10 @@ export default class Release extends SfCommand<ReleaseResult> {
     githubtag: Flags.string({
       summary: messages.getMessage('flags.githubtag.summary'),
     }),
+    oidc: Flags.boolean({
+      default: false,
+      summary: messages.getMessage('flags.oidc.summary'),
+    }),
   };
 
   public async run(): Promise<ReleaseResult> {
@@ -82,6 +86,7 @@ export default class Release extends SfCommand<ReleaseResult> {
     const pkg = await PackageRepo.create({
       ux: new Ux({ jsonEnabled: this.jsonEnabled() }),
       useprerelease: flags.prerelease,
+      useoidc: flags.oidc,
     });
 
     await pkg.writeNpmToken();

src/dependencies.ts

@@ -39,7 +39,7 @@ const DEPENDENCIES: Dependency[] = [
   {
     name: 'NPM_TOKEN',
     type: 'env',
-    condition: (flags): boolean => !flags.dryrun,
+    condition: (flags): boolean => !flags.dryrun && !flags.oidc,
   },
   {
     name: 'GH_TOKEN',

src/repository.ts

@@ -37,6 +37,7 @@ type PollFunction = () => boolean;
 type RepositoryOptions = {
   ux: Ux;
   useprerelease?: string;
+  useoidc?: boolean;
 };
 
 abstract class Repository extends AsyncOptionalCreatable<RepositoryOptions> {
@@ -81,7 +82,7 @@ abstract class Repository extends AsyncOptionalCreatable<RepositoryOptions> {
 
   public async writeNpmToken(): Promise<void> {
     const home = this.env.getString('HOME') ?? os.homedir();
-    await this.registry.setNpmAuth(home);
+    if (!this.options?.useoidc) await this.registry.setNpmAuth(home);
     await this.registry.setNpmRegistry(home);
   }