Implement npm-publish workflow via shared-workflows action

[devin-ai-integration]

Summary

Migrate NPM package publishing from GitHub Packages (JS-DevTools/npm-publish) to the new shared firefliesai/shared-workflows/.github/actions/npm-publish@main composite action.

This publishes packages to Google Artifact Registry (GAR) with automatic GitHub Packages mirroring during the migration period, using GCP Workload Identity Federation for authentication.

Key changes:

• Replace JS-DevTools/npm-publish with firefliesai/shared-workflows/.github/actions/npm-publish@main
• Add id-token: write permission (required for GCP OIDC auth)
• Use secrets.CROSS_REPO_TOKEN for cross-repo dependency access
• Add workflow_dispatch trigger for manual runs
• Remove explicit registry/scope config from setup-node (handled by the shared action)

Review & Testing Checklist for Human

• Verify the GAR service account npm-publish-ci-cd@fireflies-ai-ci-cd.iam.gserviceaccount.com has roles/artifactregistry.writer for this repo's packages
• After merge, bump a package version in package.json and push to trigger the workflow
• Verify the new version appears in GAR (https://us-npm.pkg.dev/fireflies-ai/npm/)
• Verify the new version is mirrored to GitHub Packages
• Re-run workflow via workflow_dispatch to confirm idempotency (no error on already-published version)

Notes

Follows the same pattern as fred-service #922 and ai-apps-service #578.

Note: This PR removes the direct npmjs.org publishing. If public NPM publishing is still needed, it should be handled separately from the GAR migration.

Shortcut: https://app.shortcut.com/fireflies/story/110261

Link to Devin session: https://app.devin.ai/sessions/51f58ae09a0244a6879272ec220804ba

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[coderabbitai]

Warning

Rate limit exceeded

@devin-ai-integration[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 7 minutes and 53 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d1e8d922-2162-41bc-853b-e053eac9b68c

📥 Commits

Reviewing files that changed from the base of the PR and between 1bb3ff3 and 3bff794.

📒 Files selected for processing (1)

• .github/workflows/cd.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore-sc-110261-implement-npm-publish-workflow-for-all

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[fireflies-bot]

🔍 PR Complexity Assessment

🟡 Risk Score: 3/10

[███░░░░░░░]

📝 Summary

Migrates NPM package publishing from JS-DevTools/npm-publish to firefliesai's shared-workflows composite action, switching from direct npmjs.org publishing to Google Artifact Registry with GitHub Packages mirroring.

📊 Lines Analysis

Metric	Count
Total Changes	114
Production Code	114
Test Code	0

💡 Recommendation

Verify the shared action works correctly by following the testing checklist provided. Confirm whether public npmjs.org publishing is still needed - if external consumers depend on it, this could be a breaking change. The migration pattern has been validated in other repos which reduces risk.

---

_{This assessment is automated and should be used as a guide. Please use your judgment when reviewing.}

[andrew10232]

remove this

[andrew10232]

devin, remove this

[greguintow]

devin, are you there?

[devin-ai-integration]

Hey! Yes, I'm here. Let me know if you have any feedback on this PR or need any changes.