From ae0f409eff89607049595c1667894e7a86e1ee74 Mon Sep 17 00:00:00 2001 From: Fernando Alonso Pecina Date: Thu, 22 Oct 2026 22:44:55 +0000 Subject: [PATCH 1/2] ci: migrate npm release workflows from Wombat to OSS Exit Gate --- .github/workflows/nightly.yml | 66 +++++++++++++++++++++++++++++++---- .github/workflows/publish.yml | 54 +++++++++++++++++++++++++--- 2 files changed, 109 insertions(+), 11 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index e8e28cc647..6a0d5cf909 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -8,6 +8,7 @@ on: permissions: contents: write + id-token: write jobs: check_for_changes: @@ -17,18 +18,31 @@ jobs: steps: - uses: actions/checkout@v3 + with: + persist-credentials: false - name: Check if the current commit is less than 24 hours old id: check continue-on-error: true - run: test -n "$(git rev-list --after='24 hours' ${{ github.sha }})" && echo "changed=yes" >> "$GITHUB_OUTPUT" + env: + COMMIT_SHA: ${{ github.sha }} + run: test -n "$(git rev-list --after='24 hours' "${COMMIT_SHA}")" && echo "changed=yes" >> "$GITHUB_OUTPUT" publish: needs: check_for_changes if: needs.check_for_changes.outputs.changed == 'yes' runs-on: ubuntu-latest + permissions: + contents: write + id-token: write + env: + WIF_PROVIDER: 'projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github' + EXIT_GATE_AR_URL: 'https://us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/' + EXIT_GATE_MANIFEST_GCS: 'gs://oss-exit-gate-prod-projects-bucket/material-web/npm/manifests' steps: - uses: actions/checkout@v3 + with: + persist-credentials: false - uses: actions/setup-node@v3 with: node-version: 18 @@ -46,10 +60,50 @@ jobs: git config --local user.email "action@github.com" git config --local user.name "GitHub Action" git commit -am "chore: nightly publish" - - uses: actions/setup-node@v3 + + - name: Authenticate to Google Cloud + id: auth + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 with: - node-version: 18 - registry-url: 'https://wombat-dressing-room.appspot.com/' - - run: npm publish --tag nightly + token_format: 'access_token' + workload_identity_provider: ${{ env.WIF_PROVIDER }} + + - name: Set up Cloud SDK + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3 + + - name: Stage package to OSS Exit Gate Artifact Registry + env: + ACCESS_TOKEN: ${{ steps.auth.outputs.access_token }} + run: | + cat << 'NPMRC_EOF' > "$HOME/.npmrc" + registry=https://us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/ + //us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/:always-auth=true + NPMRC_EOF + echo "//us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/:_authToken=${ACCESS_TOKEN}" >> "$HOME/.npmrc" + trap 'rm -f "$HOME/.npmrc"' EXIT + npm publish --tag nightly --registry="${EXIT_GATE_AR_URL}" + + - name: Trigger OSS Exit Gate nightly release env: - NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }} + MANIFEST_NAME: manifest-${{ github.run_id }}-${{ github.run_attempt }}.json + run: | + VERSION="$(jq -r .version package.json)" + jq -n --arg ver "${VERSION}" '{ + publish_all: false, + publishing_groups: [ + { + packages: [ + { + name: "@material/web", + version: $ver + } + ], + registry_config: { + npm: { + tags: ["nightly"] + } + } + } + ] + }' > manifest.json + gcloud storage cp manifest.json "${EXIT_GATE_MANIFEST_GCS}/${MANIFEST_NAME}" diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 318b78e2f3..ab4a6cd3dd 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -7,13 +7,23 @@ on: permissions: contents: read + id-token: write jobs: publish: runs-on: ubuntu-latest + permissions: + contents: read + id-token: write + env: + WIF_PROVIDER: 'projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github' + EXIT_GATE_AR_URL: 'https://us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/' + EXIT_GATE_MANIFEST_GCS: 'gs://oss-exit-gate-prod-projects-bucket/material-web/npm/manifests' steps: - uses: actions/checkout@v3 + with: + persist-credentials: false - uses: actions/setup-node@v3 with: node-version: 18 @@ -25,10 +35,44 @@ jobs: env: WIREIT_FAILURES: continue - - uses: actions/setup-node@v3 + - name: Authenticate to Google Cloud + id: auth + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 with: - node-version: 18 - registry-url: 'https://wombat-dressing-room.appspot.com/' - - run: npm publish + token_format: 'access_token' + workload_identity_provider: ${{ env.WIF_PROVIDER }} + + - name: Set up Cloud SDK + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3 + + - name: Stage package to OSS Exit Gate Artifact Registry + env: + ACCESS_TOKEN: ${{ steps.auth.outputs.access_token }} + run: | + cat << 'NPMRC_EOF' > "$HOME/.npmrc" + registry=https://us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/ + //us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/:always-auth=true + NPMRC_EOF + echo "//us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/:_authToken=${ACCESS_TOKEN}" >> "$HOME/.npmrc" + trap 'rm -f "$HOME/.npmrc"' EXIT + npm publish --registry="${EXIT_GATE_AR_URL}" + + - name: Trigger OSS Exit Gate release env: - NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }} + MANIFEST_NAME: manifest-${{ github.run_id }}-${{ github.run_attempt }}.json + run: | + VERSION="$(jq -r .version package.json)" + jq -n --arg ver "${VERSION}" '{ + publish_all: false, + publishing_groups: [ + { + packages: [ + { + name: "@material/web", + version: $ver + } + ] + } + ] + }' > manifest.json + gcloud storage cp manifest.json "${EXIT_GATE_MANIFEST_GCS}/${MANIFEST_NAME}" From e971636b8a0ff13c9d777d900cb6423cbaec7708 Mon Sep 17 00:00:00 2001 From: Fernando Alonso Pecina Date: Fri, 23 Oct 2026 13:38:12 +0000 Subject: [PATCH 2/2] ci: pin workflow actions to commit SHAs and scope job permissions --- .github/workflows/nightly.yml | 11 +++++------ .github/workflows/publish.yml | 7 +++---- 2 files changed, 8 insertions(+), 10 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 6a0d5cf909..b2ca6f4ac2 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -7,8 +7,7 @@ on: # allows triggering from the github UI permissions: - contents: write - id-token: write + contents: read jobs: check_for_changes: @@ -17,7 +16,7 @@ jobs: changed: ${{ steps.check.outputs.changed }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 with: persist-credentials: false - name: Check if the current commit is less than 24 hours old @@ -40,14 +39,14 @@ jobs: EXIT_GATE_MANIFEST_GCS: 'gs://oss-exit-gate-prod-projects-bucket/material-web/npm/manifests' steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 with: persist-credentials: false - - uses: actions/setup-node@v3 + - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: 18 cache: npm - - uses: google/wireit@setup-github-actions-caching/v2 + - uses: google/wireit@9d7c2e5346f8ef1b1ab6014c4e96c74e234f7ed5 # setup-github-actions-caching/v2 - run: npm ci - run: npm run build diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ab4a6cd3dd..3d4d3dbc1a 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -7,7 +7,6 @@ on: permissions: contents: read - id-token: write jobs: publish: @@ -21,14 +20,14 @@ jobs: EXIT_GATE_MANIFEST_GCS: 'gs://oss-exit-gate-prod-projects-bucket/material-web/npm/manifests' steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 with: persist-credentials: false - - uses: actions/setup-node@v3 + - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: 18 cache: npm - - uses: google/wireit@setup-github-actions-caching/v2 + - uses: google/wireit@9d7c2e5346f8ef1b1ab6014c4e96c74e234f7ed5 # setup-github-actions-caching/v2 - run: npm ci - run: npm run build