Fix issue with npm publish workflows

[jsjoeio]

@code-asher pointed out a bug with our npm publish. Based on the way download_artifact works in our lib.sh script, it always grabs the binary based on the latest release branch (i.e. v4.0.1). This means we've been publishing PR builds and beta builds using the same binary as latest 🤦‍♂️

Solution

We're going to fix this by moving the workflows into one job and moving the switch logic into the bash script. We arrived at this decision because it's the best solution given the way download_artifact works and how we utilize GitHub artifacts.

TODOs

• combine npm workflows into one job in ci.yaml
• add logic to bash script publish-npm to check which values to use based on environment variables in job
• modify download_artifact to take an argument
• make diagram that shows each of the different scenarios ("staging", "dev" and "production")

Resources

• https://kevsoft.net/2020/06/10/running-github-action-steps-and-jobs-only-on-push-to-master.html
• https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#using-an-environment
• https://stackoverflow.com/questions/58139406/only-run-job-on-specific-branch-with-github-actions
• https://github.community/t/depend-on-another-workflow/16311/24
• https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables

Notes

ENVIRONMENT: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && "production" || "staging" }}
if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
GITHUB_EVENT_NAME
GITHUB_REF

Read here for default envs: https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables

[jsjoeio]

@code-asher caught another bug. The current workflow assumes NPM_TOKEN defined. It is defined as a repo secret, but this isn't available to forks.

To fix this we need to generate a new token and add to the environment npm as a secret.

After adding secret test with:

1. fork code-server
2. open PR
3. approve workflow

Expected: it should have access to that secret and successfully publish on npm.