JS-1596 Configure eslint-plugin-sonarjs release for npm trusted publishing (#6827)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Author: zglicz

.github/workflows/.npmrc

@@ -1,3 +1,3 @@
 always-auth=true
 email=helpdesk+npmjs@sonarsource.com
-//registry.npmjs.org/:_authToken=${NPM_TOKEN}
+registry=https://registry.npmjs.org/

.github/workflows/release_eslint_plugin.yml

@@ -12,8 +12,9 @@ on:
 jobs:
   publish:
     permissions:
-      id-token: write # required for SonarSource/vault-action-wrapper
+      id-token: write # required for GitHub OIDC and SonarSource/vault-action-wrapper
     runs-on: github-ubuntu-latest-s
+    environment: release
     env:
       RELEASE_TAG: ${{ github.event.inputs.release_version }}
       NPM_REPOSITORY: "sonarsource-npm-public"
@@ -28,7 +29,6 @@ jobs:
             development/kv/data/repox url | repox_url;
             development/artifactory/token/{REPO_OWNER_NAME_DASH}-qa-deployer access_token  | qa_deployer_access_token;
             development/artifactory/token/{REPO_OWNER_NAME_DASH}-promoter access_token  | promoter_access_token;
-            development/kv/data/npmjs sonartech_npm_token  | npm_token;
             development/github/token/{REPO_OWNER_NAME_DASH}-rspec token | RSPEC_GITHUB_TOKEN;
       - name: Setup JFrog for deploy
         uses: SonarSource/jfrog-setup-wrapper@e0f353c7f1bcc7b2f663063d72b5fec7948f6815 # 3.6.0
@@ -41,7 +41,6 @@ jobs:
       - run: cp .github/workflows/.npmrc .npmrc
       - name: Publish npm package
         env:
-          NPM_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).npm_token }}
           GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).RSPEC_GITHUB_TOKEN }}
         run: |
           jfrog rt npm-config --repo-resolve npm --repo-deploy sonarsource-npm-public-qa
@@ -50,7 +49,7 @@ jobs:
           cp .npmrc lib/.npmrc
           cd lib
           npm version $RELEASE_TAG --no-git-tag-version
-          npm publish
+          npm publish --provenance
           jfrog rt npm-publish --build-name=eslint-plugin-sonarjs --build-number=${{ github.event.inputs.release_version }}
           jfrog rt build-publish eslint-plugin-sonarjs ${{ github.event.inputs.release_version }}
       - name: Promote npm package

packages/analysis/src/jsts/rules/README.md

@@ -124,7 +124,7 @@ If you have any questions, encounter any bugs, or have feature requests, please
 | [assertions-in-tests](https://sonarsource.github.io/rspec/#/rspec/S2699/javascript)                  | Tests should include assertions                                                                                                | ✅  |     |     | 💭  |     |
 | [aws-apigateway-public-api](https://sonarsource.github.io/rspec/#/rspec/S6333/javascript)            | Creating public APIs is security-sensitive                                                                                     | ✅  |     |     |     |     |
 | [aws-ec2-rds-dms-public](https://sonarsource.github.io/rspec/#/rspec/S6329/javascript)               | Allowing public network access to cloud resources is security-sensitive                                                        | ✅  |     |     |     |     |
-| [aws-ec2-unencrypted-ebs-volume](https://sonarsource.github.io/rspec/#/rspec/S6275/javascript)       | Using unencrypted EBS volumes is security-sensitive                                                                            | ✅  |     |     |     |     |
+| [aws-ec2-unencrypted-ebs-volume](https://sonarsource.github.io/rspec/#/rspec/S6275/javascript)       | EBS volumes should be encrypted                                                                                                | ✅  |     |     |     |     |
 | [aws-efs-unencrypted](https://sonarsource.github.io/rspec/#/rspec/S6332/javascript)                  | Using unencrypted EFS file systems is security-sensitive                                                                       | ✅  |     |     |     |     |
 | [aws-iam-all-privileges](https://sonarsource.github.io/rspec/#/rspec/S6302/javascript)               | Policies should not grant all privileges                                                                                       | ✅  |     |     |     |     |
 | [aws-iam-all-resources-accessible](https://sonarsource.github.io/rspec/#/rspec/S6304/javascript)     | Policies granting access to all resources of an account are security-sensitive                                                 |     |     |     |     |     |
@@ -380,7 +380,7 @@ If you have any questions, encounter any bugs, or have feature requests, please
 | [void-use](https://sonarsource.github.io/rspec/#/rspec/S3735/javascript)                             | "void" should not be used                                                                                                      | ✅  |     |     | 💭  |     |
 | [weak-ssl](https://sonarsource.github.io/rspec/#/rspec/S4423/javascript)                             | Weak SSL/TLS protocols should not be used                                                                                      | ✅  |     |     |     |     |
 | [web-sql-database](https://sonarsource.github.io/rspec/#/rspec/S2817/javascript)                     | Web SQL databases should not be used                                                                                           |     |     |     | 💭  | ❌  |
-| [x-powered-by](https://sonarsource.github.io/rspec/#/rspec/S5689/javascript)                         | Disclosing fingerprints from web application technologies is security-sensitive                                                | ✅  |     |     |     |     |
+| [x-powered-by](https://sonarsource.github.io/rspec/#/rspec/S5689/javascript)                         | Web application technologies should not disclose version information                                                           | ✅  |     |     |     |     |
 | [xml-parser-xxe](https://sonarsource.github.io/rspec/#/rspec/S2755/javascript)                       | XML parsers should not be vulnerable to XXE attacks                                                                            | ✅  |     |     |     |     |
 | [xpath](https://sonarsource.github.io/rspec/#/rspec/S4817/javascript)                                | Executing XPath expressions is security-sensitive                                                                              |     |     |     |     | ❌  |