[BRE-1935] Phase 2: Convert cd.yml to trigger-actions caller

.github/workflows/cd.yml

@@ -1,5 +1,4 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
+# This workflow triggers deployment to npm via bitwarden/deploy
 
 name: Node.js Package
 
@@ -8,22 +7,22 @@ on:
     types:
       - published
 
+permissions: {}
+
 jobs:
   format:
     name: Format
     runs-on: ubuntu-24.04
-
     permissions:
       contents: read
-
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Install NodeJS
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 20
 
@@ -33,25 +32,20 @@ jobs:
       - name: Run format
         run: npm run lint
 
-  deploy:
-    name: Deploy
-    if: ${{ github.event_name == 'release' }}
+  build:
+    name: Build
     needs: format
     runs-on: ubuntu-24.04
-
     permissions:
-      actions: write
       contents: read
-      id-token: write
-
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Install NodeJS
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 20
 
@@ -69,41 +63,30 @@ jobs:
             dist
             package.json
 
+  trigger-deploy:
+    name: Trigger deployment
+    if: ${{ github.event_name == 'release' }}
+    needs: build
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+    steps:
       - name: Log in to Azure
         uses: bitwarden/gh-actions/azure-login@main
         with:
           subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
           tenant_id: ${{ secrets.AZURE_TENANT_ID }}
           client_id: ${{ secrets.AZURE_CLIENT_ID }}
 
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
+      - name: Trigger deployment to deploy repo
+        uses: bitwarden/gh-actions/trigger-actions@main
         with:
-          keyvault: gh-org-bitwarden
-          secrets: 'BW-GHAPP-ID,BW-GHAPP-KEY'
-
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
-      - name: Generate GH App token
-        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
-        id: app-token
-        with:
-          app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
-          private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}
-          owner: bitwarden
-          repositories: passwordless-devops
-
-      - name: Dispatch deployment
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-          TAG_NAME: ${{ github.event.release.tag_name }}
-        run: >
-          gh workflow run deploy-passwordless-nodejs
-          --repo bitwarden/passwordless-devops
-          --field repository="${{ github.repository }}"
-          --field run-id="${{ github.run_id }}"
-          --field artifact="packages"
-          --field environment="npm"
-          --field version="${TAG_NAME}"
+          azure_subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          azure_tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          azure_client_id: ${{ secrets.AZURE_CLIENT_ID }}
+          task: deploy-passwordless-nodejs
+          data: |
+            {
+              "tag": "${{ github.event.release.tag_name }}"
+            }