ci: migrate npm publish to OIDC trusted publishing

[joaoloureirop]

Summary

• Update the publish workflow to MetaMask/action-npm-publish@v6 with OIDC (id-token: write) and staged NPM publishing.
• Upgrade the repo to Yarn 4.16 so the v6 publish action can run, and point CI installs at Corepack + yarn --immutable.
• Publish the built lib output (this is a single package, not a packages/**/dist monorepo).

Follow-up

• Confirm trusted publishing is configured on npm for @metamask/react-native-webview (workflow publish-release.yml, environment npm-publish).
• After the first OIDC publish succeeds, NPM_TOKEN can be removed from the npm-publish environment.

Test plan

• Confirm CI install jobs still succeed with Yarn 4 / Corepack.
• Dry-run the Publish Release workflow and check the Slack dry-run announcement.
• Confirm the real publish job requests OIDC and does not need a long-lived token after trusted publishing is set.

Made with Cursor

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• tinyglobby@0.2.17
• undici@8.10.2
• node-gyp@13.0.2
• proc-log@7.0.0
• tar@7.5.22

View full report

[joaoloureirop]

@SocketSecurity ignore npm/undici@8.10.2
@SocketSecurity ignore npm/node-gyp@13.0.2
@SocketSecurity ignore npm/proc-log@7.0.0
@SocketSecurity ignore npm/tar@7.5.22
@SocketSecurity ignore npm/tinyglobby@0.2.17

Transitive tooling from the existing React Native 0.73 example stack, surfaced by the Yarn 4 lockfile rewrite. Not new direct deps and not in the published package.

undici is Node's HTTP client (network + proxy env vars are its job).
node-gyp is the native addon build toolchain (subprocess during builds is expected).
tar/proc-log/tinyglobby are standard npm/RN install tooling.

[Mrtenz]

Can you please align the workflows more with the module template?

publish-release is typically called through the main workflow, and releases are created through the create-release-pr workflow.

[Mrtenz]

In a separate PR is fine too.

[joaoloureirop]

Done. publish-release.yml is now a workflow_call invoked from main.yml after action-is-release, and releases are opened via create-release-pr.yml.

This repo already has Android/iOS/Detox/security workflows, so main.yml only covers the release trigger rather than duplicating the full module-template CI graph. Formatter is prettier to match this package.