[alonsopf89]

Summary

Migrates the @material/web npm publishing workflows (.github/workflows/publish.yml and .github/workflows/nightly.yml) from the legacy Wombat Dressing Room proxy (https://wombat-dressing-room.appspot.com/ / NODE_AUTH_TOKEN) to OSS Exit Gate (b/496177586, b/576671324).

Key Changes

• Workload Identity Federation (WIF): Authenticates keyless via google-github-actions/auth against the OSS Exit Gate WIF provider (projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github), eliminating static NODE_AUTH_TOKEN secrets.
• Artifact Registry Staging: Stages @material/web tarballs to https://us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/.
• Release Manifest Trigger: Uploads the release manifest to gs://oss-exit-gate-prod-projects-bucket/material-web/npm/manifests/ (including registry_config.npm.tags: ["nightly"] for nightly builds).
• End-to-End Verification: Provisioned in Piper (cl/1003882089, cl/1004023214, cl/1004034531) and verified via Step 8 smoke test.

[asyncliz]

Hey @alonsopf89! Thanks for helping out with this migration. Feel free to request my review on this PR when you're ready for it, and I can help with the import and Copybara process :)

[alonsopf89]

Hi @asyncliz — the OSS Exit Gate production configuration (material-web/npm) and end-to-end Artifact Registry + GCS manifest smoke test are complete, and this PR is Ready for Review with all CI, CLA, and zizmor checks passing. Please let us know if this looks good to merge (or if you prefer to mirror it from internal Piper), after which we will submit the final ownership handoff CL. Thanks!

[asyncliz]

I added the "Ready for Google" label to kick off the Copybara import process. That will generate an internal CL that (once submitted) will merge this PR

[asyncliz]

@alonsopf89 looks like there was an error with the nightly publish: https://github.com/material-components/material-web/actions/runs/40445261508

Are there additional environment settings we need to update for the repo? If so, can you direct me towards instructions?

[alonsopf89]

Hi @asyncliz — no additional repository secrets or environment settings are needed!

The error in run #40445261508 happened because google-github-actions/auth@v3 had token_format: 'access_token' set. Since OSS Exit Gate uses Direct Workload Identity Federation (projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github) without a service account, token_format: 'access_token' tells the action to look for a service_account to impersonate. Omitting token_format: 'access_token' and reading ${{ steps.auth.outputs.auth_token }} uses the direct STS federated token (and sets GOOGLE_APPLICATION_CREDENTIALS for gcloud storage cp) with zero extra repo settings.

I opened #6096 (#6096) with the 2-line fix for both nightly.yml and publish.yml.