chore: makes npm token input optional

[jwndlng]

Changed the 'token' input requirement to optional in order to fully switch to trusted publishing (via OIDC).

[ilbertt]

We should add the enable_provenance boolean parameter as required (so that one is forced to specify the desired behavior) and set its value in the env below at line 27.

This is a breaking change, but we can easily handle it by upgrading the workflows that use this action across the org.

[jwndlng]

We should add the enable_provenance boolean parameter as required (so that one is forced to specify the desired behavior) and set its value in the env below at line 27.

This is a breaking change, but we can easily handle it by upgrading the workflows that use this action across the org.

This time I did not forget about it, but I planned it as a separate PR (have the boilerplate ready). I would make it optional and set the default to true. From a security perspective this should be enabled by default and one should intentionally disable it if needed. Wdyt?

[ilbertt]

I would make it optional and set the default to true. From a security perspective this should be enabled by default and one should intentionally disable it if needed. Wdyt?

This solution also makes sense, let's go for it then.

[ilbertt]

This time I did not forget about it, but I planned it as a separate PR (have the boilerplate ready)

Great, looking forward to it!