From 396374327db71f78bbac806d4ba7af75934d3919 Mon Sep 17 00:00:00 2001 From: mchatlas Date: Fri, 11 Sep 2026 15:14:24 +0200 Subject: [PATCH 1/2] Add npm trusted publishing test workflow --- .github/workflows/github-actions.yml | 59 ++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 .github/workflows/github-actions.yml diff --git a/.github/workflows/github-actions.yml b/.github/workflows/github-actions.yml new file mode 100644 index 0000000..45fb8fd --- /dev/null +++ b/.github/workflows/github-actions.yml @@ -0,0 +1,59 @@ +name: Build, Check, Stage Package + +on: + push: + branches: + - chore/npm-trusted-publishing + +permissions: + contents: read + id-token: write + +jobs: + stage-package: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Use Node.js 16 for build + uses: actions/setup-node@v4 + with: + node-version: 16.x + registry-url: https://registry.npmjs.org + + - name: Build + run: | + npm install + npm run build + + - name: Test + run: npm test + + - name: Set staged package version + id: version + run: | + BASE_VERSION=$(node -p "require('./package.json').version") + STAGE_VERSION="${BASE_VERSION}-oidc-test.${GITHUB_RUN_NUMBER}.${GITHUB_RUN_ATTEMPT}" + npm version "${STAGE_VERSION}" --no-git-tag-version + echo "version=${STAGE_VERSION}" >> "${GITHUB_OUTPUT}" + + - name: Pack + run: npm pack --pack-destination="./umd" + + - name: Use Node.js 24 for trusted publishing + uses: actions/setup-node@v4 + with: + node-version: 24.x + registry-url: https://registry.npmjs.org + + - name: Use npm with staged publishing support + run: npm install --global npm@11.19.1 + + - name: Stage package with trusted publishing + run: >- + npm stage publish + "./umd/hellosign-embedded-${{ steps.version.outputs.version }}.tgz" + --tag oidc-test + --access public From 0c4eb56a239e21dae0ed2a66b2d745e3d39f373b Mon Sep 17 00:00:00 2001 From: mchatlas Date: Fri, 11 Sep 2026 16:04:25 +0200 Subject: [PATCH 2/2] Consolidate package publishing workflow --- .github/workflows/github-actions.yml | 115 +++++++++++++++++---- .github/workflows/publish-beta-package.yml | 92 ----------------- .github/workflows/publish-prod-package.yml | 84 --------------- 3 files changed, 96 insertions(+), 195 deletions(-) delete mode 100644 .github/workflows/publish-beta-package.yml delete mode 100644 .github/workflows/publish-prod-package.yml diff --git a/.github/workflows/github-actions.yml b/.github/workflows/github-actions.yml index 45fb8fd..95bda75 100644 --- a/.github/workflows/github-actions.yml +++ b/.github/workflows/github-actions.yml @@ -1,17 +1,25 @@ -name: Build, Check, Stage Package +name: Build, Check, Publish on: push: branches: - - chore/npm-trusted-publishing + - main -permissions: - contents: read - id-token: write +env: + NPM_REGISTRY_URL: https://registry.npmjs.org + CDN_AWS_PUBLISH_ROLE: arn:aws:iam::301904545275:role/github-actions-oidc-role-prod-sign-embedded + CDN_BUCKET: cdn.hellosign.com + CDN_PATH: public/js/embedded + AWS_REGION: us-east-1 jobs: - stage-package: + build: + if: github.event_name == 'push' && github.ref == 'refs/heads/main' runs-on: ubuntu-latest + permissions: + contents: read + outputs: + version: ${{ steps.version.outputs.version }} steps: - name: Checkout repository @@ -21,7 +29,7 @@ jobs: uses: actions/setup-node@v4 with: node-version: 16.x - registry-url: https://registry.npmjs.org + registry-url: ${{ env.NPM_REGISTRY_URL }} - name: Build run: | @@ -31,29 +39,98 @@ jobs: - name: Test run: npm test - - name: Set staged package version + - name: Validate Semver id: version - run: | - BASE_VERSION=$(node -p "require('./package.json').version") - STAGE_VERSION="${BASE_VERSION}-oidc-test.${GITHUB_RUN_NUMBER}.${GITHUB_RUN_ATTEMPT}" - npm version "${STAGE_VERSION}" --no-git-tag-version - echo "version=${STAGE_VERSION}" >> "${GITHUB_OUTPUT}" + env: + GITHUB_TOKEN: ${{ github.token }} + run: .github/actions-scripts/validate-release-version.js + + - name: Announce version + run: echo "v${{ steps.version.outputs.version }} is the proposed new version." - name: Pack run: npm pack --pack-destination="./umd" + - name: Upload release artifacts + uses: actions/upload-artifact@v4 + with: + name: release-artifacts + path: umd + if-no-files-found: error + retention-days: 1 + + publish: + if: github.event_name == 'push' && github.ref == 'refs/heads/main' + needs: build + runs-on: ubuntu-latest + environment: npm-publish + permissions: + contents: read + id-token: write + + steps: + - name: Download release artifacts + uses: actions/download-artifact@v4 + with: + name: release-artifacts + path: release-artifacts + - name: Use Node.js 24 for trusted publishing uses: actions/setup-node@v4 with: node-version: 24.x - registry-url: https://registry.npmjs.org + registry-url: ${{ env.NPM_REGISTRY_URL }} - - name: Use npm with staged publishing support + - name: Use npm with trusted publishing support run: npm install --global npm@11.19.1 - - name: Stage package with trusted publishing + - name: Publish package with trusted publishing run: >- - npm stage publish - "./umd/hellosign-embedded-${{ steps.version.outputs.version }}.tgz" - --tag oidc-test + npm publish + "./release-artifacts/hellosign-embedded-${{ needs.build.outputs.version }}.tgz" --access public + + release: + if: github.event_name == 'push' && github.ref == 'refs/heads/main' + needs: + - build + - publish + runs-on: ubuntu-latest + permissions: + contents: write + id-token: write + + steps: + - name: Download release artifacts + uses: actions/download-artifact@v4 + with: + name: release-artifacts + path: release-artifacts + + - name: Create GitHub release + uses: actions/github-script@v7 + with: + script: | + await github.rest.repos.createRelease({ + owner: context.repo.owner, + repo: context.repo.repo, + tag_name: 'v${{ needs.build.outputs.version }}', + }); + + - name: Configure AWS credentials for production + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ env.CDN_AWS_PUBLISH_ROLE }} + aws-region: ${{ env.AWS_REGION }} + + - name: Copy development build to production CDN + run: >- + aws s3 cp + release-artifacts/embedded.development.js + s3://${{ env.CDN_BUCKET }}/${{ env.CDN_PATH }}/v${{ needs.build.outputs.version }}/ + + - name: Copy minified build to production CDN + run: >- + aws s3 cp + release-artifacts/embedded.production.min.js + s3://${{ env.CDN_BUCKET }}/${{ env.CDN_PATH }}/v${{ needs.build.outputs.version }}/ diff --git a/.github/workflows/publish-beta-package.yml b/.github/workflows/publish-beta-package.yml deleted file mode 100644 index e912f9a..0000000 --- a/.github/workflows/publish-beta-package.yml +++ /dev/null @@ -1,92 +0,0 @@ -name: Sign Embedded Beta Package - -on: - pull_request: - branches: [ "main" ] - -env: - NPM_REGISTRY_URL: "https://registry.npmjs.com" - CDN_AWS_PUBLISH_ROLE: arn:aws:iam::654344198836:role/github-actions-oidc-role-nonprod-sign-embedded - CDN_BUCKET: cdn.staging-hellosign.com - CDN_PATH: public/js/embedded - AWS_REGION: us-east-1 -jobs: - build: - permissions: - id-token: write # This is required for requesting the JWT - contents: write # This is required for publishing releases - runs-on: ubuntu-latest - strategy: - matrix: - node-version: [16.x] # we should pull this from a common place - - steps: - - uses: actions/checkout@v4 - - - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 - with: - node-version: ${{ matrix.node-version }} - registry-url: ${{ env.NPM_REGISTRY_URL }} - - - name: Build - run: | - npm install - npm run build - - - name: Test - run: | - npm test - - - name: Validate Semver - id: version - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: .github/actions-scripts/validate-release-version.js --beta - - - name: Set Beta Version - env: - PACKAGE_VERSION: ${{ steps.version.outputs.version }} - run: | - echo "Setting beta version ${PACKAGE_VERSION}" - npm version ${PACKAGE_VERSION} --no-git-tag-version - - - name: Pack - run: | - npm pack --pack-destination="./umd" - - - name: Create tag - uses: actions/github-script@v5 - with: - script: | - github.rest.git.createRef({ - owner: context.repo.owner, - repo: context.repo.repo, - ref: 'refs/tags/${{ steps.version.outputs.version }}', - tag_name: 'v${{ steps.version.outputs.version }}', - name: 'v${{ steps.version.outputs.version }}', - draft: true, - prerelease: true, - sha: context.sha - }) - - - name: Publish Beta - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - NPM_CONFIG_PROVENANCE: true - run: | - npm publish --tag beta --provenance --access=public - - - name: Configure AWS credentials for Non-Prod - id: awskeys - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: ${{ env.CDN_AWS_PUBLISH_ROLE }} - aws-region: ${{ env.AWS_REGION }} - - - name: Copy dev build to nonprod cdn - run: aws s3 cp umd/embedded.development.js s3://${{ env.CDN_BUCKET }}/${{ env.CDN_PATH }}/v${{ steps.version.outputs.version }}/ - - - name: Copy minified build to nonprod cdn - run: aws s3 cp umd/embedded.production.min.js s3://${{ env.CDN_BUCKET }}/${{ env.CDN_PATH }}/v${{ steps.version.outputs.version }}/ - diff --git a/.github/workflows/publish-prod-package.yml b/.github/workflows/publish-prod-package.yml deleted file mode 100644 index dbb1b6a..0000000 --- a/.github/workflows/publish-prod-package.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Sign Embedded Latest Package - -on: - push: - branches: [ "main" ] - -env: - NPM_REGISTRY_URL: "https://registry.npmjs.com" - CDN_AWS_PUBLISH_ROLE: arn:aws:iam::301904545275:role/github-actions-oidc-role-prod-sign-embedded - CDN_BUCKET: cdn.hellosign.com - CDN_PATH: public/js/embedded - AWS_REGION: us-east-1 -jobs: - build: - permissions: - id-token: write # This is required for requesting the JWT - contents: write # This is required for publishing releases - runs-on: ubuntu-latest - strategy: - matrix: - node-version: [16.x] # we should pull this from a common place - - steps: - - uses: actions/checkout@v4 - - - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 - with: - node-version: ${{ matrix.node-version }} - registry-url: ${{ env.NPM_REGISTRY_URL }} - - - name: Build - run: | - npm install - npm run build - - - name: Test - run: | - npm test - - - name: Validate Semver - id: version - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: .github/actions-scripts/validate-release-version.js - - - name: Announce version - run: | - echo "v${{ steps.version.outputs.version }} is the proposed new version." - - - name: Pack - run: | - npm pack --pack-destination="./umd" - - - name: Create Release - uses: actions/github-script@v5 - with: - script: | - github.rest.repos.createRelease({ - owner: context.repo.owner, - repo: context.repo.repo, - tag_name: 'v${{ steps.version.outputs.version }}', - }); - - - name: Publish - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - NPM_CONFIG_PROVENANCE: true - run: | - npm publish --provenance --access=public - - - name: Configure AWS credentials for Prod - id: awskeys - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: ${{ env.CDN_AWS_PUBLISH_ROLE }} - aws-region: ${{ env.AWS_REGION }} - - - name: Copy dev build to cdn - run: aws s3 cp umd/embedded.development.js s3://${{ env.CDN_BUCKET }}/${{ env.CDN_PATH }}/v${{ steps.version.outputs.version }}/ - - - name: Copy minified build to nonprod cdn - run: aws s3 cp umd/embedded.production.min.js s3://${{ env.CDN_BUCKET }}/${{ env.CDN_PATH }}/v${{ steps.version.outputs.version }}/ -