[ci] GitHub releases and published npm packages do not match

[pichlermarc]

We have recently updated our publish workflows to OIDC. However, due to a typo in the new workflow (resolved in #3096), we've created GitHub releases without actually publishing to npmjs.org

I have opened a PR to force a new release #3098 - once that is merged, we should be able to re-run the workflow and publish new releases that should then actually be published to npmjs.org.

I'll update the unintentionally created GitHub releases to state that the next patch release is the actual version on npmjs.org

[pichlermarc]

After a few workflow changes, we attempted to publish again, but we had another problem that ended up in the same situation - when downloading the artifact, which is a .zip file, file permissions on some scripts got lost and that prompted lerna to refuse to publish to npm.

#3107 (comment)

[pichlermarc]

We were able to publish the packages, but there's been a mismatch in the most recent GitHub releases and packages published to npmjs.com. That's because the GitHub releases were already published, and versions in package.json were already incremented. However, they were not published on their commit due to the recent changes in the publish workflow.

A GitHub release exists for each of the published packages, but the commit on the releases may not match the provenance statement on the package in npm.

Commit only matches for three packages:

• @opentelemetry/auto-instrumentations-node (published via OIDC, correct provenance statement)
• @opentelemetry/instrumentation-bunyan (published via OIDC, correct provenance statement)
• @opentelemetry/sampler-aws-xray (this is a new package and was not published via OIDC. It does not have a provenance statement. I had to publish it manually from my own machine using 2FA for the first time. It's built from 931c7b3. Subsequent releases will contain a provenance statement and will be published via OIDC)

All other packages have provenance statements pointing to 931c7b3, however the release points to c7f4e6c

To rectify the situation on the most recent releases, we'll force another release PR that will increment all fix versions (#3123), merge the corresponding release PR to publish new versions for all packages. These will all be published using OIDC, and will have the correct provenance statements attached pointing to the correct commit. Previous GitHub releases will remain as-is.

A member of @open-telemetry/javascript-maintainers will post an update here once this is done.

[trentm]

We have now successfully done a full release of packages from this repo (see #3124 (comment)), so now GH releases and npm releases are in sync.