Backport npm trusted publishing to 0.86

.github/actions/build-npm-package/action.yml

@@ -4,10 +4,6 @@ inputs:
   release-type:
     required: true
     description: The type of release we are building. It could be nightly, release or dry-run
-  gha-npm-token:
-    required: false
-    description: The GHA npm token, required only to publish to npm
-    default: ''
   gradle-cache-encryption-key:
     description: The encryption key needed to store the Gradle Configuration cache
 
@@ -38,6 +34,9 @@ runs:
         cache-encryption-key: ${{ inputs.gradle-cache-encryption-key }}
     - name: Setup node.js
       uses: ./.github/actions/setup-node
+      with:
+        node-version: '24'
+        registry-url: 'https://registry.npmjs.org'
     - name: Install dependencies
       uses: ./.github/actions/yarn-install
     - name: Build packages
@@ -46,12 +45,9 @@ runs:
     - name: Build types
       shell: bash
       run: yarn build-types --skip-snapshot
-    # Continue with publish steps
-    - name: Set npm credentials
-      if: ${{ inputs.release-type == 'release' ||
-        inputs.release-type == 'nightly' }}
-      shell: bash
-      run: echo "//registry.npmjs.org/:_authToken=${{ inputs.gha-npm-token }}" > ~/.npmrc
+    # `npm publish` below authenticates via npm Trusted Publishing (OIDC).
+    # The caller (the `publish-npm.yml` workflow) MUST grant `id-token: write`;
+    # this composite action runs inside that job.
     - name: Publish NPM
       shell: bash
       run: |

.github/actions/setup-node/action.yml

@@ -5,11 +5,19 @@ inputs:
     description: 'The node.js version to use'
     required: false
     default: '22.14.0'
+  registry-url:
+    description: |
+      Optional npm registry URL passed through to actions/setup-node. Set on
+      jobs that publish to npm so setup-node writes a `.npmrc` configured to
+      pick up the OIDC-minted token from npm Trusted Publishing.
+    required: false
+    default: ''
 runs:
-  using: "composite"
+  using: 'composite'
   steps:
     - name: Setup node.js
       uses: actions/setup-node@v6
       with:
         node-version: ${{ inputs.node-version }}
         cache: yarn
+        registry-url: ${{ inputs.registry-url }}

.github/workflows/create-release.yml

@@ -28,21 +28,6 @@ jobs:
           token: ${{ secrets.REACT_NATIVE_BOT_GITHUB_TOKEN }}
           fetch-depth: 0
           fetch-tags: 'true'
-      - name: Verify NPM token
-        run: |
-          if [[ -z "$GHA_NPM_TOKEN" ]]; then
-            echo "⚠️ No NPM token found. Skipping validation."
-            exit 0
-          fi
-          echo "//registry.npmjs.org/:_authToken=$GHA_NPM_TOKEN" > ~/.npmrc
-          if ! npm whoami > /dev/null 2>&1; then
-            echo "❌ NPM token is invalid or expired. Aborting release."
-            exit 1
-          fi
-          echo "✅ NPM token is valid ($(npm whoami))"
-          rm -f ~/.npmrc
-        env:
-          GHA_NPM_TOKEN: ${{ secrets.GHA_NPM_TOKEN }}
       - name: Check if on stable branch
         id: check_stable_branch
         run: |