chore: GH workflow to auto publish to NPM

[shivampathak232]

Description

This PR adds an automated GitHub Actions workflow for publishing the @auth0/s3 package to npm. The workflow is designed to:

Key Features:

• Automatic dry-run on PRs: When a PR is opened or updated, the workflow runs in dry-run mode to validate the package can be published without actually publishing it
• Automatic publish on merge: When a PR is merged to master, the workflow automatically publishes the package to npm
• Version detection: Automatically reads version and package name from package.json
• NPM tag auto-detection: Determines the appropriate npm dist-tag based on version:
  • alpha for versions containing "alpha"
  • beta for versions containing "beta"
  • next for versions containing "rc"
  • latest for stable versions
• Duplicate prevention: Validates that the version doesn't already exist on npm or as a git tag before publishing
• Git tagging & GitHub releases: Automatically creates git tags and GitHub releases for published versions
• Manual trigger: Supports manual workflow dispatch with optional dry-run mode

Implementation Details:

• The workflow triggers on pull_request, push to master, and workflow_dispatch events
• Uses environment variables to determine dry-run mode based on the trigger type
• Adds publishConfig to package.json for public npm registry access
• Restores package.json after workflow completion to keep the repository clean

Benefits:

• Streamlines the release process with automated checks and publishing
• Reduces human error by validating versions before publishing
• Provides visibility through PR checks showing if a version can be published
• Maintains consistency with automatic tagging and release creation

References

• Related to minimist vulnerability fix branch: fix/minimist_vulnerability
• Package registry: https://www.npmjs.com/package/@auth0/s3

Testing

Manual Testing Required:

1. Open a PR with a version bump in package.json - verify workflow runs in dry-run mode
2. Merge the PR to master - verify workflow publishes to npm (requires NPM_TOKEN secret to be configured)
3. Test manual workflow dispatch with dry-run enabled/disabled

Environment:

• GitHub Actions runner: ubuntu-latest
• Node.js version: 20
• Package manager: yarn

Note: This workflow requires the NPM_TOKEN repository secret to be configured for publishing to npm.

• This change adds test coverage for new/changed/fixed functionality (N/A - workflow only, existing tests run as part of the workflow)

Checklist

• I have added documentation for new/changed/fixed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch