feat: set trusted publishing by default in npm, pypi and nuget (#1437)

Author: iliapolo

.github/workflows/release.yml

@@ -135,6 +135,7 @@ function pythonTarget(name: string): cdk.JsiiPythonTarget {
   return {
     distName: repoName,
     module: repoName.replace(/-/g, '_'),
+    trustedPublishing: true,
   };
 }
 
@@ -151,13 +152,14 @@ function javaTarget(name: string): cdk.JsiiJavaTarget {
   };
 }
 
-function dotnetTarget(name: string) : cdk.JsiiDotNetTarget {
+function dotnetTarget(name: string): cdk.JsiiDotNetTarget {
   const repoName = node.buildRepositoryName(name);
   const artifact = repoName.substring(node.NAME_PREFIX.length);
   const pkg = code.toPascalCase(artifact).replace(/-/g, '');
   return {
     dotNetNamespace: `Org.Cdk8s${pkg ? `.${pkg}` : ''}`,
     packageId: `Org.Cdk8s${pkg ? `.${pkg}` : ''}`,
+    trustedPublishing: true,
   };
 }
 

src/projects/jsii.ts

@@ -36,6 +36,9 @@ export const fixedOptionsKeys = [
   // this is deprecated in favor of 'release'.
   // lets disallow using it.
   'releaseWorkflow',
+
+  'npmTrustedPublishing',
+  'releaseEnvironment',
 ] as const;
 export type fixedOptionsKeysType = typeof fixedOptionsKeys[number];
 
@@ -79,6 +82,8 @@ export function buildNodeProjectFixedOptions(options: Cdk8sTeamNodeProjectOption
 
     // This is the version we actually run GitHub workflows on
     workflowNodeVersion: '18.12.0',
+    npmTrustedPublishing: true,
+    releaseEnvironment: 'release',
   };
 }