[alonsopf89]

Summary

Adds .github/workflows/publish-npm.yml to publish wbn-sign (js/sign) through Google OSS Exit Gate (go/oss-exit-gate) using keyless Workload Identity Federation (WIF), matching the setup in chromeos/wbn-sign-gcp-kms#16.

• OSS Exit Gate Project: webpackage/npm (cl/1005822927)
• Artifact Registry Staging: https://us-npm.pkg.dev/oss-exit-gate-prod/webpackage--npm/
• GCS Manifest Bucket: gs://oss-exit-gate-prod-projects-bucket/webpackage/npm/manifests/
• End-to-End Smoke Test: Verified with wbn-sign@0.3.3
• Tracking Issue: b/577052994 (parent b/576673325)

cc @zgroza @cmfcmf @GrapeGreen @rferens @sonkkeli

[rferens]

Can we move to Node 24 or 26? 22 is already in maintenance mode.

[alonsopf89]

Thanks for the review @rferens! Updated .github/workflows/publish-npm.yml to use Node.js 24.x as requested.

[rferens]

Hey, sorry for so long review. I had to onboard a bit on this topic. I spotted some problems that might require your attention.

Please take a look at this one which AI spotted for me:

Artifact Registry NPM Version Immutability on Retries

Artifact Registry's npm implementation retains version tombstones: once wbn-sign@X.Y.Z is uploaded to webpackage--npm, you cannot re-upload wbn-sign@X.Y.Z to Artifact Registry—even if gcloud artifacts versions delete was run (publisher.go).

• If a run uploads to AR (npm publish) and fails before or during Exit Gate publishing, retrying the workflow for the same version will fail at npm publish unless the package entry in AR is wiped first.
• Adding gcloud artifacts packages delete wbn-sign --project=oss-exit-gate-prod --repository=webpackage--npm --location=us --quiet || true before npm publish ensures a clean staging state on retries (go/oss-exit-gate-faq#delete-ar-artifacts).

[rferens]

is there a way to test this workflow without real publishing?

[alonsopf89]

Added a dry_run boolean input on workflow_dispatch: when dry_run is checked (true), the workflow runs the build, tests, WIF authentication, and Artifact Registry staging check, then cleans up the staged package in AR and exits without uploading manifest.json to GCS (so nothing is published to public npm).

[rferens]

Maybe we should allow for only manual run? We don't use any releases now in this repo (IIUC how [published] works), and it would cause a trigger collision because we have 2 npm packages in this one repo: wbn, and wbn-sign, so not sure if we want to always update both, because they are developed separately. Do you have an idea how to separate their releases?

Also, it would be good to leave some comment or instruction how to publish (in this file or in js/CONTRIBUTING.md)

[alonsopf89]

Done! Switched to workflow_dispatch only with a package choice input (wbn-sign or wbn) so each package is built and released independently from js/sign or js/bundle, and added step-by-step publishing instructions in both .github/workflows/publish-npm.yml and js/CONTRIBUTING.md.

[rferens]

Do we always want to publish everything? Cannot be that one of packages (wbn, sign-wbn) is damaged there, while other passed tests and both are published? Maybe it should be more targetted? AI recommended me sth like:

PKG_VERSION=$(node -p "require('./package.json').version")
cat << MANIFEST > manifest.json
{
  "publish_all": false,
  "publishing_groups": [
    {
      "packages": [
        {
          "name": "wbn-sign",
          "version": "${PKG_VERSION}"
        }
      ]
    }
  ]
}
MANIFEST

[alonsopf89]

Done! Updated manifest.json to use "publish_all": false with publishing_groups targeting only ${PACKAGE_NAME} and ${PKG_VERSION}.

[alonsopf89]

Thanks for the thorough review @rferens! I've updated the PR to address all of your points:

1. Manual trigger (workflow_dispatch only) & separated wbn / wbn-sign releases: Removed release: types: [published] and configured workflow_dispatch with a package choice input (wbn-sign or wbn). The workflow dynamically selects js/sign or js/bundle so each package is built, tested, and released independently.
2. Targeted manifest.json (publish_all: false): Replaced publish_all: true with a targeted publishing_groups manifest specifying only the selected ${PACKAGE_NAME} and ${PKG_VERSION} from its package.json.
3. Artifact Registry NPM Version Immutability on Retries: Added gcloud artifacts packages delete "${PACKAGE_NAME}" --project=oss-exit-gate-prod --repository=webpackage--npm --location=us --quiet || true prior to npm publish to clear any AR version tombstones on retries.
4. Testing without real publishing (dry_run input) & documentation: Added a dry_run boolean input on workflow_dispatch that runs the full build, tests, WIF authentication, and Artifact Registry staging check, then cleans up the staged package in AR without uploading manifest.json to GCS (so nothing is published to public npm). Added step-by-step release instructions in both .github/workflows/publish-npm.yml and js/CONTRIBUTING.md.

[rferens]

Thank you very much!

[alonsopf89]

Thank you for the approval, @rferens! All 9 build / prettier / js-wbn checks are passing. Since this PR only touches .github/workflows/publish-npm.yml, a maintainer can mark it as non-substantive for the W3C IPR check or merge it whenever convenient.