🛡️ chore: Harden CI Supply Chain Workflows (#13090)

* chore: harden CI supply chain workflows

* chore: address CI hardening review feedback

* chore: tighten GitNexus dispatch hardening

* chore: use app token for Locize PR automation

* chore: use dedicated token for Locize PR automation

.github/workflows/client.yml

@@ -14,31 +14,27 @@ on:
         default: 'Manual publish requested'
 
 permissions:
-  id-token: write  # Required for OIDC trusted publishing
   contents: read
 
 jobs:
-  build-and-publish:
+  pack:
     runs-on: ubuntu-latest
-    environment: publish  # Must match npm trusted publisher config
+    outputs:
+      skip: ${{ steps.check.outputs.skip }}
     steps:
       - uses: actions/checkout@v4
-      
+
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
           node-version: '20.x'
-          registry-url: 'https://registry.npmjs.org'
-      
-      - name: Update npm for OIDC support
-        run: npm install -g npm@latest  # Must be 11.5.1+ for provenance
-        
+
       - name: Install client dependencies
         run: cd packages/client && npm ci
-        
+
       - name: Build client
         run: cd packages/client && npm run build
-        
+
       - name: Check version change
         id: check
         working-directory: packages/client
@@ -52,13 +48,47 @@ jobs:
             echo "Version changed, proceeding with publish"
             echo "skip=false" >> $GITHUB_OUTPUT
           fi
-            
+
       - name: Pack package
         if: steps.check.outputs.skip != 'true'
         working-directory: packages/client
-        run: npm pack
-        
-      - name: Publish
+        run: |
+          mkdir -p "$GITHUB_WORKSPACE/npm-package"
+          npm pack --pack-destination "$GITHUB_WORKSPACE/npm-package"
+
+      - name: Upload package
         if: steps.check.outputs.skip != 'true'
-        working-directory: packages/client
+        uses: actions/upload-artifact@v4
+        with:
+          name: librechat-client-package
+          path: npm-package/*.tgz
+          if-no-files-found: error
+          retention-days: 2
+
+  publish-npm:
+    needs: pack
+    if: github.ref == 'refs/heads/main' && needs.pack.outputs.skip != 'true'
+    runs-on: ubuntu-latest
+    environment: publish  # Must match npm trusted publisher config
+    permissions:
+      contents: read
+      id-token: write  # Required for OIDC trusted publishing
+    steps:
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install npm with OIDC support
+        run: npm install -g npm@11.14.1 --ignore-scripts
+
+      - name: Download package
+        uses: actions/download-artifact@v4
+        with:
+          name: librechat-client-package
+          path: npm-package
+
+      - name: Publish
+        working-directory: npm-package
         run: npm publish *.tgz --access public --provenance