feat: Generic & CircleCI Trusted Publishing

[dopry]

• add generic support for trusted publishing via NPM_ID_TOKEN to decouple semantic release from CI platforms.
• document trusted publishing with CircleCI

fixes #1121

[z4ce]

@travi any way you could consider merging this so those of us using semantic release on circle can use trusted publishing?

[travi]

one of my hesitations with this approach is the generic handling. the npm docs still only list three supported providers. suggesting that a generic approach can work beyond that list goes beyond what i think the npm team has defined. i'm ok with adding circle to our supported list, but i think i would still want to handle it specifically rather than generically.

i think the path to more generic support depends on what the npm team ends up doing with npm/cli#8525 because i want to avoid us being in the game of keeping up with each additional ci provider enabled by the npm team

[travi]

Must be configured in your CI job

i think we need some adjustment here to clarify that this is only needed for specific ci providers. the current wording doesnt make it clear that this is not required in the context of github actions, for example

[dopry]

@travi what would you suggest?

[chammond-tz]

What if you just added "This is not required when using trusted publishing in Github Actions." after the parenthetical and before the "takes priority..."?

[z4ce]

@dopry would you be able to modify the PR to address @travi 's concerns and scope it to just circle until the generic question is answered upstream?

[dopry]

one of my hesitations with this approach is the generic handling. the npm docs still only list three supported providers. suggesting that a generic approach can work beyond that list goes beyond what i think the npm team has defined. i'm ok with adding circle to our supported list, but i think i would still want to handle it specifically rather than generically.

i think the path to more generic support depends on what the npm team ends up doing with npm/cli#8525 because i want to avoid us being in the game of keeping up with each additional ci provider enabled by the npm team

I specifically did the 'generic' so the semantic-release team wouldn't need to chase every added CI provider and because that is the way npm works in practice, even if it's not documented that way. Frankly, its saddening that NPM is picking specific vendors to support over creating open standards in this case.