Repository navigation
Publish @bitgo-beta #3219
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish @bitgo-beta | |
| on: | |
| workflow_dispatch: | |
| # push: | |
| # branches: | |
| # - master | |
| permissions: | |
| contents: write | |
| id-token: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| env: | |
| SOCKET_SECURITY_MODE: monitor # Options: monitor (non-blocking) or block (fails on vulnerabilities) | |
| jobs: | |
| publish: | |
| name: Publish Release | |
| runs-on: ubuntu-latest | |
| # Normal runs finish well inside this. The worst case stacks the lerna-step | |
| # prepack timeout (20 min), the global propagation wait (15 min), recovery | |
| # bumps, and the fallback publish's own sibling wait (20 min) — this cap | |
| # covers that with headroom while still failing out of a registry outage | |
| # instead of holding the runner for hours. | |
| timeout-minutes: 100 | |
| # Restricts @bitgo-beta/@bitgo-alpha publishing to protected branches via | |
| # a deployment branch policy on this environment, so the job cannot run | |
| # from arbitrary PR branches even though it is manually dispatched. | |
| environment: beta-alpha-release | |
| steps: | |
| - uses: socketdev/action@4337a545deecc20f19a909e52db7a2f6ba292f42 # v1 | |
| with: | |
| mode: firewall-free | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Setup Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version-file: .nvmrc | |
| - name: Install BitGoJS | |
| run: sfw yarn install --with-frozen-lockfile | |
| # osv-scanner has no severity filter and exits non-zero on ANY finding, | |
| # so run it with continue-on-error and let the severity gate below | |
| # decide pass/fail based on CVSS score (fails on HIGH/CRITICAL only). | |
| - name: Audit Dependencies | |
| id: osv-scan | |
| continue-on-error: true | |
| uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 | |
| with: | |
| scan-args: |- | |
| --config=osv-scanner.toml | |
| --format=json | |
| --output-file=osv-results.json | |
| ./ | |
| - name: Enforce Vulnerability Severity Threshold | |
| uses: ./.github/actions/osv-severity-gate | |
| with: | |
| scan-outcome: ${{ steps.osv-scan.outcome }} | |
| - name: Set Environment Variable for Alpha | |
| if: github.ref != 'refs/heads/master' # only publish changes if on feature branches | |
| run: | | |
| echo "preid=alpha" >> $GITHUB_ENV | |
| - name: Set Environment Variable for Beta | |
| if: github.ref == 'refs/heads/master' # only publish changes if on master branches | |
| run: | | |
| echo "preid=beta" >> $GITHUB_ENV | |
| - name: Configure Git | |
| run: | | |
| git config --global user.name 'Git bot' | |
| git config --global user.email 'bot@noreply.github.com' | |
| git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }} | |
| git checkout -b ${{ env.preid }}-$(git rev-parse --short HEAD) | |
| - name: Configure NPM for Trusted Publishing | |
| run: | | |
| echo "@bitgo-beta:registry=https://registry.npmjs.org" >> .npmrc | |
| - name: Prepare Release | |
| run: | | |
| rm -rfd ./modules/web-demo | |
| rm -rfd ./modules/express | |
| npx tsx ./scripts/prepare-release.ts ${{ env.preid }} | |
| - name: Rebuild packages | |
| run: sfw yarn | |
| - name: Commit Local Changes | |
| run: git commit -am "Auto updated ${{ env.preid }} branch" --no-verify || echo "No changes to commit" | |
| - name: Lerna Publish (siblings) | |
| # The lerna exit code is not a reliable failure signal: a Rekor TLOG 409 is | |
| # usually a duplicate submission of provenance whose registry write already | |
| # completed, and npm can report failure for versions it then publishes fine. | |
| # Verify Publish is the registry-truth gate: it polls the exact-version | |
| # endpoint and only republishes (bumping the version on staged conflicts) | |
| # for packages that genuinely never landed. Set RECOVERY_MODE=false in that | |
| # script's env to restore fail-fast behavior. | |
| continue-on-error: true | |
| run: yarn lerna publish from-package --preid ${{ env.preid }} --dist-tag ${{ env.preid }} --force-publish --yes --loglevel silly | |
| env: | |
| NPM_CONFIG_PROVENANCE: true | |
| - name: Lerna Publish (bitgo) | |
| # Non-fatal for the same reason as the siblings step; a bitgo failure here | |
| # (e.g. its prepack sibling-visibility wait timing out) is retried by | |
| # Verify Publish with BITGO_GENERATE_SHRINKWRAP enabled. | |
| continue-on-error: true | |
| run: | | |
| bitgo_name=$(jq -r '.name' modules/bitgo/package.json) | |
| yarn lerna publish from-package --include-private "$bitgo_name" --preid ${{ env.preid }} --dist-tag ${{ env.preid }} --force-publish --yes --loglevel silly | |
| env: | |
| NPM_CONFIG_PROVENANCE: true | |
| BITGO_GENERATE_SHRINKWRAP: true | |
| - name: Verify Publish | |
| run: npx tsx ./scripts/verify-release.ts ${{ env.preid }} | |
| env: | |
| NPM_CONFIG_PROVENANCE: true | |
| RECOVERY_MODE: true |