Setup release based build trigger and trusted publishing

[lwasser]

We are SO SO close to a new release on npm!!

The last item to setup is

1. a trigger in our build action that will deploy to npm
2. trusted publishing with NPM to make that secure
3. a gha envt that any maintain can approve deployment for ✨

UNLESS we want to have a specific deployment sub-team?? that might be too much.

@JimMadge do you have any thoughts or preferences here? we could just start with permissions for the entire team and test it out. I will create a animated gif in the docs that outlines the process when i create the pr for this so it's super clear how to release!!

[lwasser]

Or perhaps maybe NPM managers should have deploy rights only? i am not sure what is best here :)

[Berkmann18]

IMO, NPM should be as automated as possible.

[lwasser]

thanks @Berkmann18 i'm worried about security with the automated releases. Atleast from what i've learned in the python ecosystem it's good to have a human in the loop and to have the actions super locked down. I'm curious what others think. So what i'm thikning it it's all automated UNTIL that last push to npm which a human triggers here in the actions tab.

[jdalrymple]

I think your plan is sound - the merge button is protected by maintainers, which necessitates having a human in the loop to protect the releases. I'd probably also enforce a couple reviews on each PR if possible once weve cleaned up the backlog just to ensure a few sets of eyes on what ever gets pushed forward.

[lwasser]

That is a good point. Its also super easy to un protect a environment . Ill work on this over the weekend and setup Trusted Publishing too.