ci: Add npm publish step to gnd binary build workflow

.github/workflows/gnd-binary-build.yml

@@ -2,6 +2,11 @@ name: Build gnd Binaries
 
 on:
   workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Dry-run npm publish (no actual publish)'
+        type: boolean
+        default: false
 
 jobs:
   build:
@@ -18,7 +23,7 @@ jobs:
             runner: ubuntu-22.04
             asset_name: gnd-linux-aarch64
           - target: x86_64-apple-darwin
-            runner: macos-13
+            runner: macos-14
             asset_name: gnd-macos-x86_64
           - target: aarch64-apple-darwin
             runner: macos-latest
@@ -29,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Rust toolchain
         run: |
@@ -104,7 +109,7 @@ jobs:
           7z a -tzip ${{ matrix.asset_name }}.zip ${{ matrix.asset_name }}
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.asset_name }}
           path: |
@@ -119,7 +124,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup GitHub CLI
         run: |
@@ -129,7 +134,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
 
@@ -156,4 +161,107 @@ jobs:
           # Upload Windows x86_64 asset
           gh release upload $VERSION artifacts/gnd-windows-x86_64.exe/gnd-windows-x86_64.exe.zip --repo $GITHUB_REPOSITORY
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish-npm:
+    name: Publish npm package for ${{ matrix.platform }}
+    needs: release
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux-x64
+            asset: gnd-linux-x86_64.gz
+            os_field: linux
+            cpu_field: x64
+            extract: gunzip
+          - platform: linux-arm64
+            asset: gnd-linux-aarch64.gz
+            os_field: linux
+            cpu_field: arm64
+            extract: gunzip
+          - platform: darwin-x64
+            asset: gnd-macos-x86_64.gz
+            os_field: darwin
+            cpu_field: x64
+            extract: gunzip
+          - platform: darwin-arm64
+            asset: gnd-macos-aarch64.gz
+            os_field: darwin
+            cpu_field: arm64
+            extract: gunzip
+          - platform: win32-x64
+            asset: gnd-windows-x86_64.exe.zip
+            os_field: win32
+            cpu_field: x64
+            extract: unzip
+    steps:
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
+      - name: Download gnd binary
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release download "${{ github.ref_name }}" \
+            --repo "${{ github.repository }}" \
+            --pattern "${{ matrix.asset }}" \
+            --output ./binary-archive
+
+      - name: Extract binary
+        run: |
+          mkdir -p pkg/bin
+          if [ "${{ matrix.extract }}" = "gunzip" ]; then
+            gunzip -c ./binary-archive > pkg/bin/gnd
+            chmod +x pkg/bin/gnd
+          else
+            unzip ./binary-archive -d pkg/bin
+            mv pkg/bin/*.exe pkg/bin/gnd.exe
+          fi
+
+      - name: Create package.json
+        shell: bash
+        run: |
+          VERSION="${{ github.ref_name }}"
+          VERSION="${VERSION#v}"
+
+          if [ "${{ matrix.os_field }}" = "win32" ]; then
+            BIN_PATH="./bin/gnd.exe"
+          else
+            BIN_PATH="./bin/gnd"
+          fi
+
+          cat > pkg/package.json << EOF
+          {
+            "name": "@graphprotocol/gnd-${{ matrix.platform }}",
+            "version": "${VERSION}",
+            "description": "gnd binary for ${{ matrix.platform }}",
+            "os": ["${{ matrix.os_field }}"],
+            "cpu": ["${{ matrix.cpu_field }}"],
+            "bin": {
+              "gnd": "${BIN_PATH}"
+            },
+            "publishConfig": {
+              "access": "public",
+              "provenance": true
+            },
+            "license": "(Apache-2.0 OR MIT)",
+            "repository": {
+              "type": "git",
+              "url": "https://github.com/graphprotocol/graph-node.git"
+            }
+          }
+          EOF
+
+      - name: Publish
+        run: npm publish --provenance --access public ${{ inputs.dry_run && '--dry-run' || '' }}
+        working-directory: pkg
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GRAPHPROTOCOL_NPM_TOKEN }}