Update release workflows for trusted publishing

[delucis]

Changes

• Moves the snapshot release job into the same file as the regular release job. This is because trusted publishing only allows setting a single workflow file that has permission to publish.
• Updates both jobs for trusted publishing
• Pins the various actions in use (I’ve upgraded a few while doing so if I considered them “safe” updates)
• I’m not 100% certain if the permissions I’ve given the snapshot release job are sufficient for its step posting a PR comment. They’re the same permissions as we use for a regular changeset publish so I guess we’ll have to try it and find out.

Todo:

• Update https://www.npmjs.com/package/@astrojs/compiler settings to point to release.yml in withastro/compiler

Testing

Hard to test tbh.

Docs

n/a

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2f229a5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[delucis]

This has been a default since 2020, so I removed it.

[delucis]

We were using this not even pinned to a version just @main which is a bit scary. v0.0.4 was released a while ago, and all the unreleased changes since are Dependabot updates which don’t seem to have ever made it to the dist, so this pin should be equivalent to what we were previously doing.

[delucis]

The previous snapshot release workflow also set NODE_AUTH_TOKEN here and specified a registry-url in the setup-node step. I’ve never seen that before, but IIUC this step is the same as any other changeset publish, so I removed that and applied the same approach we do everywhere else for trusted publishing.

[HiDeoo]

Mostly reviewed the trusted publishing related changes as I'm less familiar with the snapshot release process and it's mostly just moved between workflows.

All the changes makes sense to me and looks correct.

I’m not 100% certain if the permissions I’ve given the snapshot release job are sufficient for its step posting a PR comment.

I think this should be fine as for repository permissions for "Pull requests", the /repos/{owner}/{repo}/issues/{issue_number}/comments endpoint to create a comment says to have at least one of the following permission sets:

"Issues" repository permissions (write)
"Pull requests" repository permissions (write)

[HiDeoo]

Tiny nit: I don't think we need/use this id?

[delucis]

Ah well spotted. Same in both jobs. Will remove.

[delucis]

Done in 2f229a5

(Well… it will be once I’m able to push again 😅 see https://www.githubstatus.com/incidents/5q7nmlxz30sk)