From cbe4d4d849272d459a6a7bd4457d02ddaa3fb6a6 Mon Sep 17 00:00:00 2001 From: Fernando Alonso Pecina Date: Fri, 23 Oct 2026 19:39:14 +0000 Subject: [PATCH 1/4] ci: migrate npm release workflow to OSS Exit Gate Pin GitHub Actions to full commit SHAs to satisfy zizmor/unpinned-uses. Bug: b/576681325, b/576673325 --- .github/workflows/release-please.yml | 47 +++++++++++++++++++--------- 1 file changed, 33 insertions(+), 14 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index be174874..2e7ca1bb 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -23,6 +23,7 @@ on: permissions: contents: write pull-requests: write + id-token: write name: Release Please @@ -32,7 +33,7 @@ jobs: steps: - id: release name: Release Please - uses: googleapis/release-please-action@v4 + uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4 with: release-type: node @@ -44,11 +45,11 @@ jobs: - if: ${{ steps.release.outputs.release_created }} name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - if: ${{ steps.release.outputs.release_created }} name: Setup Node for Dependency Installation - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: 20 cache: npm @@ -57,17 +58,35 @@ jobs: name: Install Dependencies run: npm ci - # Now configure node with the registry used for publishing - - if: ${{ steps.release.outputs.release_created }} - name: Setup Node for Publishing - uses: actions/setup-node@v3 + - name: Authenticate to Google Cloud for OSS Exit Gate + if: ${{ steps.release.outputs.release_created }} + id: auth + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 with: - node-version: 20 - registry-url: "https://wombat-dressing-room.appspot.com/" + token_format: 'access_token' + workload_identity_provider: 'projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github' - - if: ${{ steps.release.outputs.release_created }} - name: Publish - # npm publish will trigger the build via the prepack hook - run: npm publish + - name: Set up Cloud SDK + if: ${{ steps.release.outputs.release_created }} + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3 + + - name: Stage to Artifact Registry and trigger OSS Exit Gate + if: ${{ steps.release.outputs.release_created }} env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_WOMBAT_TOKEN }} + ACCESS_TOKEN: ${{ steps.auth.outputs.access_token }} + RUN_ID: ${{ github.run_id }} + RUN_ATTEMPT: ${{ github.run_attempt }} + run: | + cat << 'NPMRC' > "$HOME/.npmrc" + registry=https://us-npm.pkg.dev/oss-exit-gate-prod/js-api-loader--npm/ + //us-npm.pkg.dev/oss-exit-gate-prod/js-api-loader--npm/:always-auth=true + //us-npm.pkg.dev/oss-exit-gate-prod/js-api-loader--npm/:_authToken=${ACCESS_TOKEN} + NPMRC + trap 'rm -f "$HOME/.npmrc"' EXIT + npm publish --access public --registry="https://us-npm.pkg.dev/oss-exit-gate-prod/js-api-loader--npm/" + cat << 'MANIFEST' > manifest.json + { + "publish_all": true + } + MANIFEST + gcloud storage cp manifest.json "gs://oss-exit-gate-prod-projects-bucket/js-api-loader/npm/manifests/manifest-${RUN_ID}-${RUN_ATTEMPT}.json" From 997f623c105fad8ff22907e7b27c7efe78f2baa2 Mon Sep 17 00:00:00 2001 From: alonsopf89 Date: Wed, 4 Nov 2026 11:35:01 -0800 Subject: [PATCH 2/4] ci: clean up stale releases from staging repo before publishing --- .github/workflows/release-please.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 2e7ca1bb..024dfc01 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -70,6 +70,25 @@ jobs: if: ${{ steps.release.outputs.release_created }} uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3 + - name: Clean up stale releases from staging repo + run: | + # clean up stale releases from staging repo + packages=$(gcloud artifacts packages list \ + --project="oss-exit-gate-prod" \ + --location="us" \ + --repository="js-api-loader--npm" \ + --format="value(name)" 2>/dev/null) + + echo "${packages}" | xargs -r -I {} sh -c ' + package_name=$(basename "{}") + echo "Deleting package: $package_name..." + gcloud artifacts packages delete "{}" \ + --project="\'"oss-exit-gate-prod"\'" \ + --location="\'"us"\'" \ + --repository="\'js-api-loader--npm\'" \ + --quiet + ' + - name: Stage to Artifact Registry and trigger OSS Exit Gate if: ${{ steps.release.outputs.release_created }} env: From e277cec1468ca76bd6e2c2090a4f1b73d9fec289 Mon Sep 17 00:00:00 2001 From: alonsopf89 Date: Wed, 4 Nov 2026 21:40:08 +0000 Subject: [PATCH 3/4] ci(release): fix quote syntax in stale release cleanup step --- .github/workflows/release-please.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 024dfc01..e000f36b 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -83,9 +83,9 @@ jobs: package_name=$(basename "{}") echo "Deleting package: $package_name..." gcloud artifacts packages delete "{}" \ - --project="\'"oss-exit-gate-prod"\'" \ - --location="\'"us"\'" \ - --repository="\'js-api-loader--npm\'" \ + --project=""oss-exit-gate-prod"" \ + --location=""us"" \ + --repository="js-api-loader--npm" \ --quiet ' From bfb7a4f5cb90e22e89179fd2aa7b2d6f0dd4de65 Mon Sep 17 00:00:00 2001 From: alonsopf89 Date: Wed, 4 Nov 2026 19:57:54 -0800 Subject: [PATCH 4/4] ci: fix quote syntax in staging repo cleanup step --- .github/workflows/release-please.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index e000f36b..56f1dac5 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -83,8 +83,8 @@ jobs: package_name=$(basename "{}") echo "Deleting package: $package_name..." gcloud artifacts packages delete "{}" \ - --project=""oss-exit-gate-prod"" \ - --location=""us"" \ + --project="oss-exit-gate-prod" \ + --location="us" \ --repository="js-api-loader--npm" \ --quiet '