node-release.yml

name: node-release

on:
  push:
    tags:
      - "npm-v*"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}
  queue: max

jobs:
  verify:
    if: github.repository == 'openai/codex-security'
    name: verify
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      NPM_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
      PNPM_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
      COREPACK_NPM_REGISTRY: https://openai.firewall.socket.dev/npm/
      BUN_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
    outputs:
      artifact-id: ${{ steps.upload.outputs.artifact-id }}
      mode: ${{ steps.release.outputs.mode }}
      version: ${{ steps.release.outputs.version }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Socket Firewall
        uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2
        with:
          mode: firewall-free
          firewall-version: "1.15.0"

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "22.13.0"
          package-manager-cache: false

      - name: Activate Socket Firewall
        shell: bash
        run: |
          set -euo pipefail

          npm_registry="https://openai.firewall.socket.dev/npm/"
          pypi_registry="https://openai.firewall.socket.dev/pypi/simple/"
          {
            printf 'NPM_CONFIG_REGISTRY=%s\n' "$npm_registry"
            printf 'npm_config_registry=%s\n' "$npm_registry"
            printf 'PNPM_CONFIG_REGISTRY=%s\n' "$npm_registry"
            printf 'pnpm_config_registry=%s\n' "$npm_registry"
            printf 'COREPACK_NPM_REGISTRY=%s\n' "$npm_registry"
            printf 'YARN_NPM_REGISTRY_SERVER=%s\n' "$npm_registry"
            printf 'BUN_CONFIG_REGISTRY=%s\n' "$npm_registry"
            printf 'UV_DEFAULT_INDEX=%s\n' "$pypi_registry"
            printf 'UV_INDEX_URL=%s\n' "$pypi_registry"
            printf 'PIP_INDEX_URL=%s\n' "$pypi_registry"
          } >> "$GITHUB_ENV"

      - name: Set up Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: "1.3.14"
          no-cache: true

      - name: Enable pnpm
        shell: bash
        run: corepack enable && corepack prepare "$(node -p 'require("./sdk/typescript/package.json").packageManager')" --activate

      - name: Validate release tag
        id: release
        shell: bash
        run: |
          set -euo pipefail
          version="$(
            node sdk/typescript/scripts/release-automation.mjs release-tag \
              "$GITHUB_REF_TYPE" \
              "$GITHUB_REF" \
              "$GITHUB_REF_NAME" \
              sdk/typescript/package.json
          )"
          git fetch origin main
          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
            echo "npm release tags must point to a commit on main." >&2
            exit 1
          fi
          if ! published_versions="$(
            sfw npm view @openai/codex-security versions --json
          )"; then
            published_versions="$(
              printf '%s\n' "$published_versions" |
                node sdk/typescript/scripts/release-automation.mjs \
                  initial-published-versions "$version"
            )"
          fi
          mode="$(
            printf '%s\n' "$published_versions" |
              node sdk/typescript/scripts/release-automation.mjs \
                release-mode "$version"
          )"
          if [[ "$mode" == "recover" ]]; then
            echo "Recovering the already-published npm release."
          fi
          {
            printf 'version=%s\n' "$version"
            printf 'mode=%s\n' "$mode"
          } >> "$GITHUB_OUTPUT"

      - name: Install dependencies
        run: sfw pnpm --dir sdk/typescript install --frozen-lockfile

      - name: Audit production dependencies
        run: sfw pnpm --dir sdk/typescript run audit:prod

      - name: Verify
        run: |
          pnpm --dir sdk/typescript run types
          pnpm --dir sdk/typescript run test
          pnpm --dir sdk/typescript run format
          pnpm --dir sdk/typescript run build

      - name: Pack
        working-directory: sdk/typescript
        shell: bash
        run: |
          set -euo pipefail
          npm pkg set "gitHead=$GITHUB_SHA"
          pnpm pack --pack-destination ../../dist

      - name: Inspect package
        working-directory: sdk/typescript
        shell: bash
        env:
          CODEX_SECURITY_EXPECTED_GIT_HEAD: ${{ github.sha }}
        run: pnpm run check:package ../../dist/*.tgz

      - name: Recover the published npm release archive
        if: steps.release.outputs.mode == 'recover'
        shell: bash
        env:
          RELEASE_VERSION: ${{ steps.release.outputs.version }}
        run: |
          set -euo pipefail
          shopt -s nullglob

          built_archives=(dist/*.tgz)
          if (( ${#built_archives[@]} != 1 )); then
            echo "Expected exactly one verified local release tarball." >&2
            exit 1
          fi

          recovery="$(mktemp -d)"
          trap 'rm -rf "$recovery"' EXIT
          npm pack "@openai/codex-security@$RELEASE_VERSION" \
            --ignore-scripts \
            --pack-destination "$recovery" \
            --registry=https://registry.npmjs.org/

          published_archives=("$recovery"/*.tgz)
          if (( ${#published_archives[@]} != 1 )); then
            echo "Expected exactly one published npm release tarball." >&2
            exit 1
          fi

          metadata="$(
            npm view "@openai/codex-security@$RELEASE_VERSION" \
              name version gitHead dist.integrity dist.attestations \
              --json \
              --registry=https://registry.npmjs.org/
          )"
          printf '%s\n' "$metadata" |
            node sdk/typescript/scripts/release-automation.mjs \
              verify-publication \
              "${published_archives[0]}" \
              "$RELEASE_VERSION" \
              "$GITHUB_SHA"

          cp "${published_archives[0]}" "${built_archives[0]}"

      - name: Smoke test package
        shell: bash
        run: |
          set -euo pipefail
          consumer="$(mktemp -d)"
          trap 'rm -rf "$consumer"' EXIT
          printf '%s\n' '{"name":"codex-security-smoke","private":true,"type":"module"}' > "$consumer/package.json"
          sfw npm install --ignore-scripts --prefix "$consumer" --include=optional --no-audit --no-fund ./dist/*.tgz
          (cd "$consumer" && node --input-type=module --eval 'const sdk = await import("@openai/codex-security"); if (typeof sdk.CodexSecurity !== "function") process.exit(1);')
          "$consumer/node_modules/.bin/codex-security" --version
          "$consumer/node_modules/.bin/codex-security" --help

      - name: Upload verified package
        id: upload
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: npm-release-tarball
          path: dist/*.tgz
          if-no-files-found: error
          retention-days: 30
          compression-level: 0

  publish:
    if: github.repository == 'openai/codex-security'
    name: publish
    needs: verify
    runs-on: ubuntu-latest
    environment: npm
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout release verification source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24.15.0"
          registry-url: "https://registry.npmjs.org"
          package-manager-cache: false

      - name: Install provenance-capable npm
        shell: bash
        run: |
          set -euo pipefail
          npm_tools="$RUNNER_TEMP/codex-security-provenance-npm"
          npm install \
            --prefix "$npm_tools" \
            --ignore-scripts \
            --no-audit \
            --no-fund \
            --registry=https://openai.firewall.socket.dev/npm/ \
            npm@11.12.1

          if [[ "$("$npm_tools/node_modules/.bin/npm" --version)" != "11.12.1" ]]; then
            echo "npm 11.12.1 is required to verify Sigstore attestations." >&2
            exit 1
          fi
          printf '%s\n' "$npm_tools/node_modules/.bin" >> "$GITHUB_PATH"

      - name: Verify bundled trusted-publishing npm
        shell: bash
        run: |
          set -euo pipefail
          node --eval '
            const version = process.argv[1];
            const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
            const [major, minor, patch] = match?.slice(1).map(Number) ?? [];
            if (
              !match ||
              major < 11 ||
              (major === 11 && (minor < 5 || (minor === 5 && patch < 1)))
            ) {
              console.error(
                "npm 11.5.1 or newer is required for trusted publishing; found " +
                  version +
                  ".",
              );
              process.exit(1);
            }
          ' "$(npm --version)"

      - name: Download verified package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          artifact-ids: ${{ needs.verify.outputs.artifact-id }}
          path: dist
          merge-multiple: true
          digest-mismatch: error

      - name: Verify recovered npm release provenance
        if: needs.verify.outputs.mode == 'recover'
        shell: bash
        env:
          RELEASE_VERSION: ${{ needs.verify.outputs.version }}
        run: |
          set -euo pipefail
          shopt -s nullglob

          release_version="$RELEASE_VERSION"
          archives=(dist/*.tgz)
          if (( ${#archives[@]} != 1 )); then
            echo "Expected exactly one recovered npm release tarball." >&2
            exit 1
          fi
          archive="${archives[0]}"

          metadata="$(
            npm view "@openai/codex-security@$release_version" \
              name version gitHead dist.integrity dist.attestations \
              --json \
              --registry=https://registry.npmjs.org/
          )"
          printf '%s\n' "$metadata" |
            node sdk/typescript/scripts/release-automation.mjs \
              verify-publication "$archive" "$release_version" "$GITHUB_SHA"

          consumer="$(mktemp -d)"
          trap 'rm -rf "$consumer"' EXIT
          npm install \
            --prefix "$consumer" \
            --ignore-scripts \
            --omit=optional \
            --no-audit \
            --no-fund \
            --registry=https://registry.npmjs.org/ \
            "@openai/codex-security@$release_version"
          npm audit signatures \
            --prefix "$consumer" \
            --registry=https://registry.npmjs.org/ \
            --json \
            --include-attestations |
            node sdk/typescript/scripts/release-automation.mjs \
              verify-recovered-provenance \
              "$archive" \
              "$release_version" \
              "$GITHUB_SHA" \
              "$GITHUB_REPOSITORY"

      - name: Revalidate protected release tag
        if: needs.verify.outputs.mode == 'publish'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          invalid_tag() {
            echo "Protected npm release tag must still point to the verified commit." >&2
            exit 1
          }

          if [[ "$GITHUB_REF_TYPE" != "tag" ||
                "$GITHUB_REF" != "refs/tags/$GITHUB_REF_NAME" ]]; then
            invalid_tag
          fi

          if ! tag_fields="$(
            gh api \
              "repos/$GITHUB_REPOSITORY/git/ref/tags/$GITHUB_REF_NAME" \
              --jq '[.object.type, .object.sha] | @tsv'
          )"; then
            invalid_tag
          fi
          IFS=$'\t' read -r tag_type tag_object <<< "$tag_fields"
          if [[ ! "$tag_object" =~ ^[0-9a-f]{40}$ ]]; then
            invalid_tag
          fi

          case "$tag_type" in
            commit)
              tag_commit="$tag_object"
              ;;
            tag)
              if ! tag_commit="$(
                gh api \
                  "repos/$GITHUB_REPOSITORY/git/tags/$tag_object" \
                  --jq 'if .object.type == "commit" then .object.sha else empty end'
              )"; then
                invalid_tag
              fi
              ;;
            *)
              invalid_tag
              ;;
          esac

          if [[ ! "$tag_commit" =~ ^[0-9a-f]{40}$ ||
                "$tag_commit" != "$GITHUB_SHA" ]]; then
            invalid_tag
          fi
          echo "Protected npm release tag matches the verified commit."

      - name: Publish initial npm release
        if: needs.verify.outputs.mode == 'publish' && github.ref_name == 'npm-v0.1.0'
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_FIRST_PUBLISH_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${NODE_AUTH_TOKEN:-}" ]]; then
            echo "Security Products must configure NPM_FIRST_PUBLISH_TOKEN in the protected npm environment before the initial release." >&2
            exit 1
          fi
          npm publish ./dist/*.tgz --provenance --access public --tag latest

      - name: Publish to npm using trusted publishing
        if: needs.verify.outputs.mode == 'publish' && github.ref_name != 'npm-v0.1.0'
        run: npm publish ./dist/*.tgz --provenance --access public --tag latest