Refactor the GitHub Actions release workflow in repository cytoscape/cytoscape.js so that the npm publish logic is moved out of .github/workflows/feature-release.yml into its own dedicated reusable workflow file under .github/workflows/.

Context:

• The current workflow file is .github/workflows/feature-release.yml on branch unstable.
• The current workflow includes a step named Publish Package To npmjs that runs npm publish using NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}.
• We want minimal changes/effort while making the npm publish portion exist in its own YAML file.
• The publish should happen from master after the existing merge/release preparation completes.
• Remove use of NPM_TOKEN from the refactor.
• The user explicitly chose: reusable workflow called from feature-release.yml, publish from master, remove NPM_TOKEN.

Requirements:

1. Create a new reusable workflow file for npm publish, e.g. .github/workflows/npm-publish.yml (exact filename can be chosen if a better repository-consistent name exists).
2. Update .github/workflows/feature-release.yml to call the reusable workflow as a separate job after the existing release-preparation job succeeds.
3. Ensure the reusable workflow checks out master before publishing.
4. Configure the reusable workflow for GitHub/npm trusted publishing rather than token-based npm auth:
   • no NODE_AUTH_TOKEN
   • no NPM_TOKEN
   • include any required workflow/job permissions such as id-token: write and contents: read if needed.
   • use the appropriate npm publish invocation for trusted publishing/provenance if appropriate.
5. Preserve the rest of the release flow as much as possible, minimizing unrelated changes.
6. Make sure any data needed by downstream release steps is still available after removing the inline publish step. If VERSION or other values need to be shared between jobs/workflows, implement a minimal robust mechanism.
7. Keep the resulting workflows valid GitHub Actions YAML.

Please inspect the repository as needed to make the refactor correct and minimal. Then create a pull request with the changes.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: Could this step be separated into another yaml file and "called" from this yaml file somehow? I want to use the trusted publishing from npm with github actions and there needs to be just one yaml file with the npm publish part

Assistant: Yes — you can separate the npm publish logic into another YAML file and call it from the main workflow by using a reusable workflow (workflow_call). That’s the GitHub Actions feature designed for exactly this kind of sharing. Publishing Node.js packages

For your case, that means you can keep your existing feature-release.yml for release orchestration, and move the npm publish job into a single dedicated workflow file such as .github/workflows/npm-publish.yml. Then feature-release.yml can call that reusable workflow. This is the cleanest way to keep one canonical npm publishing workflow while still triggering it from another workflow. Publishing Node.js packages

A few important caveats:

1. Reusable workflows are called at the job level, not step level.
   So if by “this step” you literally mean one steps: entry, you can’t uses: another YAML file from inside steps: unless it’s a composite action. If you want another workflow YAML to be called, you must move that logic into its own job/workflow and call it with uses: ./.github/workflows/npm-publish.yml. Publishing Node.js packages

2. For npm publishing with provenance / trusted publishing, GitHub’s Node publishing example requires at least:

   • contents: read
   • id-token: write
     Those permissions need to be present in the job that does the publish. Publishing Node.js packages

3. GitHub’s publishing example for npm still shows NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} along with npm publish --provenance. If you are specifically switching to npm trusted publishing to avoid long-lived npm tokens, you’ll want the publish workflow to be the only place where the npm publish happens, and then configure npm trusted publishing on the npm side to trust that GitHub Actions workflow identity. The GitHub docs confirm the id-token: write requirement for provenance-related publishing. Publishing Node.js packages

A typical structure would look like this:

feature-release.yml

n...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

*This pull request was created from Copilot chat.*
>