NPM publishing

[ofalvai]

Summary

Adds a GitHub Actions workflow that publishes @bitrise/code-push-sdk to npm whenever a vX.Y.Z tag is pushed, using npm's OIDC-based Trusted Publishing instead of a long-lived npm token.

Changes

• package.json: renamed the package to @bitrise/code-push-sdk, updated homepage/repository/author to point at this repo, and changed version to the placeholder string "set-at-publish" — the git tag is now the single source of truth for the published version, injected by CI right before publish (never committed back), so this field no longer needs manual bumping per release.
• .github/workflows/publish.yml (new): triggers on v*.*.* tag pushes.
• mise.toml: bumped node from 22 to 24, since npm's OIDC trusted-publishing flow requires npm >= 11.5.1, which Node 24 bundles by default (Node 22 ships npm 10.x).

Why Trusted Publishing instead of an NPM_TOKEN secret

This is a public repo, so CI logs are world-readable, and 2025 saw multiple supply-chain incidents (tj-actions/changed-files, the Shai-Hulud npm worm) that specifically harvested long-lived NPM_TOKEN/GITHUB_TOKEN secrets out of CI. Trusted Publishing (GA July 2025) removes that attack surface entirely:

• No npm token stored in GitHub secrets — nothing to leak from logs or a compromised action.
• The workflow requests a short-lived OIDC identity token (permissions: id-token: write) that GitHub signs, asserting which repo/workflow is running.
• npm verifies that token against a "Trusted Publisher" entry registered once on the package's settings page (org/repo/workflow filename must match exactly).
• --provenance additionally attaches a signed build attestation to the published package.

The publish workflow itself only triggers on tag pushes (not pull_request/pull_request_target), so fork PRs can never run it.

Manual setup (already done for the bootstrap publish)

Trusted Publisher entries can only be registered for a package that already exists on npm, so the very first version under this new scope/name had to be published manually once: https://www.npmjs.com/package/@bitrise/code-push-sdk?activeTab=versions

After that, the Trusted Publisher was registered at npmjs.com/package/@bitrise/code-push-sdk/access (GitHub Actions, org bitrise-io, repo react-native-code-push, workflow filename publish.yml). All subsequent releases go through this workflow with no secrets involved — just push a vX.Y.Z tag.

[BirmacherAkos]

What about Expo? Can we add Expo as keyword?

[ofalvai]

Good idea, fixed

[BirmacherAkos]

What about these 2 commands?

[ofalvai]

This is actually dead code, RNPM was archived 10 years ago: https://github.com/rnpm/rnpm

I'll have a follow-up PR where all of these dead configs are removed