fix: switch from secrets to inputs in npm-publish

npm-publish/README.md

@@ -13,6 +13,16 @@ Publishes the package to the NPM registry with configurable scope and registry U
 | `registry-url`    | <p>Registry URL for publishing.</p> | `false`  | `https://registry.npmjs.org/`          |
 | `scope`           | <p>Package scope to use.</p>        | `false`  | `@ivuorinen`                           |
 | `package-version` | <p>The version to publish.</p>      | `false`  | `${{ github.event.release.tag_name }}` |
+| `npm_token`       | <p>NPM token.</p>                   | `true`   | `""`                                   |
+
+### Outputs
+
+| name              | description                         |
+|-------------------|-------------------------------------|
+| `registry-url`    | <p>Registry URL for publishing.</p> |
+| `scope`           | <p>Package scope to use.</p>        |
+| `package-version` | <p>The version to publish.</p>      |
+| `npm_token`       | <p>NPM token.</p>                   |
 
 ### Runs
 
@@ -40,4 +50,10 @@ This action is a `composite` action.
     #
     # Required: false
     # Default: ${{ github.event.release.tag_name }}
+
+    npm_token:
+    # NPM token.
+    #
+    # Required: true
+    # Default: ""
 ```

npm-publish/action.yml

@@ -21,6 +21,24 @@ inputs:
     description: 'The version to publish.'
     required: false
     default: ${{ github.event.release.tag_name }}
+  npm_token:
+    description: 'NPM token.'
+    required: true
+    default: ''
+
+outputs:
+  registry-url:
+    description: 'Registry URL for publishing.'
+    value: ${{ inputs.registry-url }}
+  scope:
+    description: 'Package scope to use.'
+    value: ${{ inputs.scope }}
+  package-version:
+    description: 'The version to publish.'
+    value: ${{ inputs.package-version }}
+  npm_token:
+    description: 'NPM token.'
+    value: ${{ inputs.token }}
 
 runs:
   using: composite
@@ -31,12 +49,12 @@ runs:
     - name: Authenticate NPM
       shell: bash
       run: |
-        echo "//${{ inputs.registry-url }}/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
+        echo "//${{ inputs.registry-url }}/:_authToken=${{ inputs.npm_token }}" > ~/.npmrc
 
     - name: Publish Package
       shell: bash
       env:
-        NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        NPM_TOKEN: ${{ inputs.npm_token }}
       run: |
         pkg_version=$(node -p "require('./package.json').version")
         if [ "$pkg_version" != "${{ inputs.package-version }}" ]; then