Add workflow to publish npm packages

[AlanGreene]

Changes

Add workflow to handle automatically publishing packages to the npm registry when the commit message matches the expected format: Publish <version> of the @tektoncd/dashboard-* packages

For PRs it validates the PR is up-to-date with the base branch and that the PR title and commit message match.

For both PRs and pushes it validates that the version in the commit message matches the version in the package.json files.

Once all validation passes, it will publish the package (dry-run for PR).

This simplifies the process of releasing new package versions as now it only requires running the npm version --workspaces <version> command and committing the result. The rest of the process, i.e. ensuring inter-workspace dependencies are updated to use the correct versions before publishing, is handled by the workflow.

Also generate provenance statements for the packages.

Skip all steps if commit message or PR title don't match expected format so the job passes and doesn't block unrelated PRs for dependency updates etc.

/kind misc

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Docs included if any changes are user facing
• Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including
  functionality, content, code)
• Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
• Release notes block below has been updated with any user facing changes (new features, significant UI changes, API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
• Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

NONE

[tekton-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[briangleeson]

/lgtm

[briangleeson]

/lgtm

[AlanGreene]

Tide is treating a skipped job as failed. This was fixed in a later prow release so we would need to update. As we're currently moving significant amounts of work off prow we'll hold off on the update for now.

See https://github.com/kubernetes-sigs/prow/issues/130 for details of the change.

I'll revisit this workflow in a week or two when I have time to change how we handle the conditional execution to avoid leaving skipped jobs, or decide that we'll live with it since it'll only run when package.json and package-lock.json files are updated in the PR.

/hold

[briangleeson]

/lgtm

[AlanGreene]

/hold cancel

[AlanGreene]

/retest

[AlanGreene]

Let's merge this and if it becomes annoying having to override the publish step on dependabot or other PRs modifying the package.json / package-lock.json files we can disable the job temporarily until we have a cleaner approach.

/override publish

[AlanGreene]

Doesn't look like /override is going to work for us… 🤔

[AlanGreene]

/hold

[AlanGreene]

/hold cancel

[AlanGreene]

Moved the PR title / commit message check to the first step so the job will run (previously skipped which was causing the issues above), but then skip the remaining steps if it's not a publish commit. Because the job runs in this case but all steps are skipped, it is marked as successful and doesn't block unrelated PRs changing the package.json / package-lock.json files (e.g. dependabot or other dependency / config updates).

[briangleeson]

/lgtm

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: briangleeson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [briangleeson]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment