[X-Guardian]

Description

We can't use npm OIDC trusted publishing today because the same packages publish from two different workflow files, and npm's trusted-publisher config matches on a single workflow filename. Consolidating into one file unblocks OIDC and removes NPM_TOKEN from the loop.

Summary

• Merge release_next.yml into release.yml so the same workflow file publishes both the release and @next channels - a precondition for switching to npm OIDC trusted publishing (npm binds trusted publishers to repository + workflow filename).
• Extract the publish phase into a reusable release-publish.yml workflow called twice (once per channel). Replaces 10 nearly-identical publish jobs (npm / pypi / maven / nuget / golang × release/next) with 2 callers.
• Add publib to root devDependencies; replace npx -p publib publib-X with yarn publib-X so publib is version-pinned and not re-resolved on every run. Required publib >= 0.2.1009 for OIDC support (we pin to ^0.2.1047).
• Scaffold the OIDC switch (permissions: id-token: write, NPM_TRUSTED_PUBLISHER: "true") as commented-out lines, ready to uncomment once trusted publishers are configured on npmjs.com.

Checklist

• I have updated the PR title to match CDKTN's style guide
• I have run the linter on my code locally
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation if applicable
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works if applicable
• New and existing unit tests pass locally with my changes

[jsteinich]

There's definitely room for additional consolidation (release and next have some differences, but wouldn't be too much effort to conditionalize), but we could do that in a follow-up PR.

I also think we could just skip the whole next flow when we are doing an actual release. It's a bunch of CI time for something that is unlikely to actually be used (it's the same code). That could also be done in a follow-up.

[X-Guardian]

Agreed that there is room for further refinement. In this PR I intentionally tried to not change the behaviour of the current workflows to keep the diff to a minimum.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days. This helps our maintainers find and focus on the active issues. If you've found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.