Add GitHub publish workflow for npm provenance

.github/workflows/npm_publish.yml

@@ -0,0 +1,21 @@
+name: Publish Package to npmjs
+on:
+  push:
+    tags:
+      - "*.*.*" # This ensures the workflow runs on any newly created tag
+  workflow_dispatch: # This allows the workflow to be triggered manually
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+          registry-url: 'https://registry.npmjs.org'
+      - run: ./scripts/publish_by_tag.sh 452 "${{ github.ref_name }}" "dist/hiveio-workerbee-${{ github.ref_name }}.tgz" build
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

scripts/publish_by_tag.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+# This script is intended to download artifacts from the latest pipeline with
+# job named "build" from given GitLab project, and then publish it to npm with provenance
+#
+# Example usage for project WorkerBee:
+#
+# ./scripts/publish_by_tag.sh 452 1.27.6-rc5 "dist/hiveio-workerbee-1.27.6-rc5.tgz" build
+
+set -e
+
+PROJECT_ID=${1:?Missing arg \#1 - GitLab project id}
+TAG=${2:?Missing arg \#2 - TAG name}
+TGZ_PATH=${3:?Missing arg \#3 - TGZ Artifacts filepath}
+JOB_NAME=${4:?Missing arg \#4 - Job name containing the tgz artifacts}
+
+API_PREFIX="https://gitlab.syncad.com/api/v4/projects/${PROJECT_ID}"
+
+CHECK_REPO_EXISTANCE_ERROR_MSG=$(curl -s "${API_PREFIX}" | jq -r ".message")
+
+if [ "${CHECK_REPO_EXISTANCE_ERROR_MSG}" != "null" ]; then
+  echo "Error fetching source repository. Cause: \"${CHECK_REPO_EXISTANCE_ERROR_MSG}\""
+  exit 1
+fi
+
+TGZ_PULL_URL="${API_PREFIX}/jobs/artifacts/${TAG}/raw/${TGZ_PATH}?job=build"
+
+TARGET_FILEPATH=/tmp/$(basename "${TGZ_PATH}")
+
+echo "Downloading artifact from \"${TGZ_PULL_URL}\" to \"${TARGET_FILEPATH}\""
+
+curl -o "${TARGET_FILEPATH}" "${TGZ_PULL_URL}"
+
+echo "Publishing artifacts to npm with provenance for tag \"${TAG}\""
+
+npm publish --access public --provenance "${TARGET_FILEPATH}"