ci: publish npm packages via trusted publishing, stage releases, add dry_run

[Danielku15]

Note

AI-authored disclosure (alphatab-ai-authored-v1)

Portions of this content were authored by an AI agent. The agent has read
AGENTS.md and the human submitter accepts responsibility for
compliance with the rules in that document.

Issues

No issue: this changes only the build and publishing setup (CI and release infrastructure), not alphaTab's behavior. The maintainer explicitly granted the exception to the accepted-issue rule.

Proposed changes

npm trusted publishing (OIDC)

The web packages are now published using short-lived GitHub OIDC credentials instead of the long-lived NPMJS_AUTH_TOKEN secret. A token stored in repository secrets can leak or be stolen and then used from anywhere; an OIDC credential is only issued to the publish.yml and release.yml workflows of this repository. npm also generates provenance attestations automatically, so consumers can verify which commit and workflow built each version.

• ~publish_web.yml: id-token: write on the build job, NODE_AUTH_TOKEN removed.
• publish.yml / release.yml: grant id-token: write to the web job. A reusable workflow can't get more permissions than its caller grants.
• repository.url in the five published packages: coderline/alphaTab → CoderLine/alphaTab. npm compares this to the repository the publish comes from, case-sensitively, and rejects the publish if they differ.

Releases are staged and need a manual approval

• Nightlies (publish.yml, tag alpha) still publish directly.
• Releases (release.yml, tag latest) run npm stage publish. A staged version only goes live after a maintainer approves it with 2FA (npm stage approve <id> or on npmjs.com). So a compromised release build can't push a latest version without that approval.
• The publish step installs npm@11 (currently 11.21.1), because staged publishing needs npm 11.15 or newer and the npm bundled with lts/* is older.

Known limitation: npm can't restrict a trusted publisher to certain dist-tags. Because the nightly entry may publish directly, it could technically also publish under latest. Staging every nightly would close that gap, but would mean approving five packages every day.

dry_run input for manual runs

publish.yml and release.yml get a dry_run checkbox that builds and verifies every platform without publishing:

Platform	Dry run
web	npm publish / npm stage publish --dry-run --loglevel verbose: does the full npm OIDC login and checks package contents, skips the upload
dotnet	Builds and packs, then lists the .nupkg files that would be pushed (dotnet nuget push has no dry-run mode)
kotlin	Builds and signs, then publishes to the local DistPath Maven repository instead of Maven Central

In publish.yml, a dry run also forces all platforms to build, regardless of recent changes. In nightly.mts, the --dry-run argument replaces the DRY_RUN environment variable, which only printed the commands and wasn't used by any workflow.

Verification

Dry runs of e3f4835 on all three platforms. Nothing was published; the registry dist-tags are unchanged.

	Publish run 39025727369 (nightly)	Release run 39025730124 (staged)
web	5/5 packages: OIDC login worked (Successfully retrieved and set token), provenance enabled, Publishing … with tag alpha (dry-run)	5/5 packages: OIDC login worked, provenance enabled, Staging … with tag latest (dry-run)
dotnet	AlphaTab / AlphaTab.Windows 1.9.0-alpha.1961 packed, push skipped	AlphaTab / AlphaTab.Windows 1.9.0 packed, push skipped
kotlin	Built and signed (signMavenPublication), published to the local DistPath repository	Built and signed (signMavenPublication), published to the local DistPath repository

Not covered by a dry run: whether each npm entry may publish directly or only stage. npm only checks this on a real upload, so the first real nightly and the first release will confirm it. Likewise, the NuGet API key and the Maven Central credentials are only checked on a real push.

npm configuration (done)

Each of the five packages has two trusted-publisher entries for CoderLine/alphaTab, with no environment and dist-tag management off:

• publish.yml: npm publish allowed
• release.yml: stage only

Follow-ups after merge

1. Confirm the first trusted nightly published and the new versions show provenance on npmjs.com.
2. On the first release, approve the staged packages, then check that the latest tag moved (npm view @coderline/alphatab dist-tags).
3. Set each package to "Require two-factor authentication and disallow tokens", revoke the old npm token and delete the NPMJS_AUTH_TOKEN secret.

Checklist

• I consent that this change becomes part of alphaTab under its current or any future open source license
• This PR is linked to an accepted issue (see above): maintainer-granted exception, infrastructure only
• Changes are implemented
• New tests were added: none. This only changes CI and publishing; it was verified with the dry runs listed above.
• I have read AGENTS.md if an AI helped draft any part of this PR

AI authorship disclosure

• No AI agent authored any part of this PR (description, code, tests, or commit messages)
• An AI agent contributed to this PR. The AI-authored disclosure block
  (alphatab-ai-authored-v1) is present at the top of this body, and I have
  personally reviewed every change and can explain each one

Further details

• This is a breaking change
• This change will require update of the documentation/website

🤖 Generated with Claude Code