main.yaml

name: Build

# IMPORTANT: npm Trusted Publisher bindings for the 21 published @adobe/* packages point
# to this file (adobe/spacecat-shared / .github/workflows/main.yaml). Renaming or moving
# this file breaks OIDC publishing — re-run scripts/setup-npm-trusted-publishers.sh after.
# Renaming the 'npm-publish' GitHub Environment referenced below has the same silent-break
# failure mode — re-run the setup script after.
#
# Trust binding security relies on the 'npm-publish' GitHub Environment having a
# deployment_branch_policy that allows only `main`. That branch policy is the server-side
# enforcement of the OIDC token's `environment` claim — without it, the binding's
# `--environment npm-publish` filter is decorative. Branch protection on `main` (PR review
# required, disallow direct push) is the second leg of the security model.
#
# Required reviewers on the 'npm-publish' environment are INTENTIONALLY disabled to
# avoid a single-timezone bottleneck on routine releases (semantic-release auto-publishes
# every meaningful merge to `main`). To re-enable a human gate, see "Re-enabling the
# environment approval gate" in docs/RELEASE-RUNBOOK.md. Branch protection on `main`
# remains the load-bearing PR review gate; the env approval is a release-stamp on
# something already approved at PR time.
# See: https://docs.npmjs.com/trusted-publishers

# No workflow-level permissions — each job declares only what it needs.
permissions: {}

on:
  push:
  # workflow_dispatch enables manual re-trigger for incident recovery
  # (see docs/RELEASE-RUNBOOK.md "Failure mode 3"). The release job's
  # `if: github.ref == 'refs/heads/main'` and `environment: npm-publish`
  # (deployment_branch_policy: main-only, no required reviewers — see header)
  # still gate publish.
  workflow_dispatch:

env:
  CI_BUILD_NUM: ${{ github.run_id }}
  CI_BRANCH: ${{ github.ref_name }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # AWS ECR OIDC (data-access IT tests)
      contents: read
      issues: read
    steps:
      - name: Check out
        uses: actions/checkout@v6
        with:
          persist-credentials: 'false'

      - name: Verify SR_NO_NPM_AUTH guard consistency
        # @semantic-release/npm must be skipped in the Test-job dry-run: that job has no
        # npm publish auth (OIDC works only in the release job, which has id-token: write
        # + the npm-publish environment), so the plugin's verifyConditions npm-whoami would
        # fail here. The skip is driven by SR_NO_NPM_AUTH: 'true' on the dry-run step below,
        # gated in every .releaserc.cjs. This is PERMANENT, not a bootstrap shim — #1592
        # added SR_NO_NPM_AUTH in the same change that removed NPM_TOKEN from the dry-run.
        # This step enforces that the env var AND the guard in every .releaserc.cjs stay
        # present; neither may be removed (doing so red-lines the dry-run on every PR).
        #
        # The anchored regex (indented key + 'true' | "true" | true) is robust to quote-style
        # reformatting from Prettier/yamllint and is syntactically distinct from the JS
        # strict-equality this step looks for in configs, so it cannot self-reference.
        run: |
          set -euo pipefail
          shopt -s nullglob
          files=(.releaserc.cjs packages/*/.releaserc.cjs)
          if [ ${#files[@]} -eq 0 ]; then
            echo "FAIL: no .releaserc.cjs files found — guard check cannot verify anything."
            echo "      Has the monorepo layout changed? Update this step's file glob."
            exit 1
          fi
          # Per-file existence assertion: catches a stale glob expansion or a
          # symlink-to-nowhere that would otherwise turn into grep exit code 2
          # (silently swallowed by `|| true` below).
          for f in "${files[@]}"; do
            [ -f "$f" ] || { echo "FAIL: expected config not found or not a regular file: $f"; exit 1; }
          done

          # The SR_NO_NPM_AUTH skip is permanent (see comment above). Enforce BOTH legs:
          # the workflow env var must stay declared, and every .releaserc.cjs must keep the
          # matching guard. Removing either breaks the dry-run.
          #
          # Anchor: YAML mapping `<indent>SR_NO_NPM_AUTH: 'true' | "true" | true` at
          # end-of-value (no trailing chars that would denote a different key/value).
          if ! grep -qE "^[[:space:]]+SR_NO_NPM_AUTH:[[:space:]]+('true'|\"true\"|true)[[:space:]]*\$" .github/workflows/main.yaml; then
            echo "FAIL: SR_NO_NPM_AUTH: 'true' is missing from the dry-run step env."
            echo ""
            echo "It is required and permanent — the Test-job dry-run has no npm publish auth,"
            echo "so @semantic-release/npm must be skipped there. Restore it; do not remove it."
            exit 1
          fi
          # Every .releaserc.cjs must include the strict guard. Accept both JS quote styles
          # so Prettier reformats don't cause spurious fails.
          missing=$(grep -L -E "SR_NO_NPM_AUTH === ['\"]true['\"]" "${files[@]}" || true)
          if [ -n "$missing" ]; then
            echo "FAIL: SR_NO_NPM_AUTH guard missing in:"
            echo "$missing"
            echo ""
            echo "Each .releaserc.cjs must gate @semantic-release/npm on:"
            echo "  ...(process.env.SR_NO_NPM_AUTH === 'true' ? [] : [\"@semantic-release/npm\"]),"
            exit 1
          fi

      - name: Set up JDK 17
        uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Setup Node & NPM
        uses: ./.github/actions/setup-node-npm
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
        env:
          MYSTICAT_DATA_SERVICE_REPO_READ_TOKEN: ${{ secrets.MYSTICAT_DATA_SERVICE_REPO_READ_TOKEN }}

      - name: Verify package-lock.json is in sync
        # Lockfile drift guard. semantic-release bumps each package's
        # package.json + CHANGELOG on release but does NOT regenerate the root
        # package-lock.json (the @semantic-release/git `assets` list in every
        # .releaserc.cjs is package.json + CHANGELOG.md only). When a released
        # workspace version later crosses a consumer's exact internal pin (e.g.
        # cloud-manager-client -> spacecat-shared-ims-client), the lock loses
        # the matching resolution and EVERY branch then fails `npm ci` with
        # "Missing <pkg>@<ver> from lock file" — a main-wide breakage that first
        # surfaces on unrelated PRs. Regenerate the lock with the same pinned
        # npm (11.13.0, installed by the Setup Node & NPM composite above) and
        # fail if it changed, so drift is caught on the PR that introduces it.
        # The Release job keeps main's lock in sync after every release (see the
        # "Sync package-lock.json after release" step), so on a healthy main
        # this regeneration is a no-op.
        shell: bash
        run: |
          set -euo pipefail
          npm install --package-lock-only --ignore-scripts
          if ! git diff --quiet -- package-lock.json; then
            echo "FAIL: package-lock.json is out of sync with the workspace package.json files."
            echo "      Fix: run 'npm install --package-lock-only' locally and commit package-lock.json."
            echo "----- drift -----"
            git --no-pager diff -- package-lock.json
            exit 1
          fi
          echo "OK: package-lock.json is in sync."

      - name: Lint, Test, Coverage Upload
        uses: ./.github/actions/lint-test-coverage
        with:
          ecr_pull_role_arn: ${{ secrets.AWS_ECR_PULL_ROLE_ARN }}
          aws_region: us-east-1

      - name: Semantic Release (Dry Run)
        if: github.ref != 'refs/heads/main'
        run: npm run semantic-release-dry
        env:
          GITHUB_TOKEN: ${{ secrets.ADOBE_BOT_GITHUB_TOKEN }}
          # SR_NO_NPM_AUTH skips @semantic-release/npm in the plugin chain (see all .releaserc.cjs).
          # PERMANENT, not a bootstrap shim: this dry-run has no npm publish auth (OIDC is
          # release-job-only), so @semantic-release/npm's verifyConditions npm-whoami would fail
          # here without it. #1592 added it in the same change that removed NPM_TOKEN from this
          # step. Do not remove (the "Verify SR_NO_NPM_AUTH guard consistency" step enforces it).
          SR_NO_NPM_AUTH: 'true'

  release:
    name: Release
    runs-on: ubuntu-latest
    needs: test
    # Skip the release job on the chore(release) commits semantic-release pushes
    # back to main. The guard matches semantic-release-monorepo's actual commit
    # subject prefix (`chore(release):`) rather than the substring `[skip ci]`
    # anywhere in the message — a substring match misfires on any commit whose
    # body or PR description quotes the skip-ci convention (which trapped this
    # PR's own commit 395f4921; see commit 2475850e for the workaround).
    # Belt-and-suspenders: also AND with [skip ci] presence so a future
    # chore(release): subject without [skip ci] does not get silently skipped.
    if: github.ref == 'refs/heads/main' && !(startsWith(github.event.head_commit.message, 'chore(release)') && contains(github.event.head_commit.message, '[skip ci]'))
    environment: npm-publish
    timeout-minutes: 15
    concurrency:
      # Serialize releases on main so semantic-release's tag-then-publish flow
      # (which assumes serialized execution) cannot race when two PRs land close
      # together. cancel-in-progress: false — a half-completed release leaves
      # inconsistent state on npm + git tags; let an in-flight one finish.
      group: npm-publish-main
      cancel-in-progress: false
    permissions:
      id-token: write   # npm OIDC Trusted Publishing
      contents: write
      issues: read
    env:
      MYSTICAT_DATA_SERVICE_REPO_READ_TOKEN: ${{ secrets.MYSTICAT_DATA_SERVICE_REPO_READ_TOKEN }}
      # NPM_CONFIG_PROVENANCE makes sigstore (status.sigstore.dev) a release prerequisite.
      # Sigstore outage break-glass: temporarily set to 'false' to publish without
      # provenance attestation for that release, then revert once sigstore recovers.
      NPM_CONFIG_PROVENANCE: 'true'
    steps:
      - name: Check out
        uses: actions/checkout@v6
        with:
          persist-credentials: 'false'

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          # Single source of truth — keeps the release job's Node version in
          # lockstep with the test job's (which pulls from .nvmrc via the
          # setup-node-npm composite action). A future .nvmrc bump no longer
          # has to be applied in two places.
          node-version-file: '.nvmrc'

      - name: Update NPM
        run: npm install -g npm@11.13.0

      - name: Configure Git auth for private Mysticat types repo
        run: |
          git config --global url."https://x-access-token:${MYSTICAT_DATA_SERVICE_REPO_READ_TOKEN}@github.com/adobe/mysticat-data-service".insteadOf "https://github.com/adobe/mysticat-data-service"
          git config --global --add url."https://x-access-token:${MYSTICAT_DATA_SERVICE_REPO_READ_TOKEN}@github.com/adobe/mysticat-data-service".insteadOf "ssh://git@github.com/adobe/mysticat-data-service"
          git config --global --add url."https://x-access-token:${MYSTICAT_DATA_SERVICE_REPO_READ_TOKEN}@github.com/adobe/mysticat-data-service".insteadOf "git@github.com:adobe/mysticat-data-service"

      - name: Install dependencies
        run: npm ci

      - name: Semantic Release
        run: npm run semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.ADOBE_BOT_GITHUB_TOKEN }}

      - name: Sync package-lock.json after release
        # semantic-release bumps the released package versions but does not
        # regenerate the root package-lock.json (see the Test job's drift
        # guard). Left unsynced, the lock's resolutions for internal exact pins
        # go stale the moment a released workspace version crosses a consumer's
        # pin, breaking `npm ci` on every branch. Regenerate the lock against
        # the just-published versions and, if it changed, commit it straight to
        # main with [skip ci] (GitHub natively skips workflow runs for commits
        # whose head message contains [skip ci], so this triggers no new CI or
        # release run). Best-effort: this must NEVER fail a release — the
        # packages are already published and the Test-job drift guard is the
        # backstop — hence continue-on-error. If the push loses a race it is
        # left for the next PR's drift guard to surface.
        if: success()
        continue-on-error: true
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.ADOBE_BOT_GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          # continue-on-error keeps this step from failing a release, which also
          # means a failure is otherwise invisible. Surface ANY failure (regen,
          # commit, or the push+rebase retry) as a workflow ::warning:: + run
          # summary line so the operator sees it without digging through logs;
          # the next PR's drift guard is still the backstop (RELEASE-RUNBOOK
          # Failure mode 7). errexit makes a failed `npm install` an honest red
          # mark instead of a false "already in sync" — the `if ! git push`
          # retry below is errexit-safe (the negated condition suppresses it).
          trap 'echo "::warning title=package-lock sync after release failed::Lockfile sync did not complete; see RELEASE-RUNBOOK Failure mode 7. The next PR drift guard will surface residual drift."; echo "package-lock.json sync after release failed — see RELEASE-RUNBOOK Failure mode 7." >> "$GITHUB_STEP_SUMMARY"' ERR
          npm install --package-lock-only --ignore-scripts
          if git diff --quiet -- package-lock.json; then
            echo "OK: package-lock.json already in sync; nothing to commit."
            exit 0
          fi
          echo "package-lock.json drifted after release; committing a sync commit to main."
          git config user.name "semantic-release-bot"
          git config user.email "semantic-release-bot@martynus.net"
          git add package-lock.json
          # `chore(release):` subject so the release-job skip guard above also
          # skips this commit (belt-and-suspenders alongside the native [skip ci]
          # skip), matching how that guard is documented.
          git commit -m "chore(release): sync package-lock.json after release [skip ci]"
          # Authenticate via http.extraHeader (base64 Basic auth) rather than
          # embedding the token in the remote URL. git echoes the remote URL in
          # push/pull error output, so a URL-embedded token can leak into logs if
          # Actions' secret masking misses the exact substring; the header value
          # is never echoed. Mirrors how actions/checkout injects credentials.
          # Pre-mask the base64 form (which is NOT auto-masked, being a distinct
          # string from the raw secret) before it can reach any log line.
          auth_b64="$(printf 'x-access-token:%s' "${GH_TOKEN}" | base64 | tr -d '\n')"
          echo "::add-mask::${auth_b64}"
          remote="https://github.com/${GITHUB_REPOSITORY}.git"
          git_auth() { git -c "http.extraheader=AUTHORIZATION: basic ${auth_b64}" "$@"; }
          # Releases are serialized (concurrency: npm-publish-main), so a race is
          # unlikely, but retry once against the latest main just in case. KNOWN
          # LIMITATION: a SECOND concurrent push landing within this retry window
          # still loses — by design we do not loop. continue-on-error keeps it
          # from failing the release, the ERR trap surfaces a ::warning::, and the
          # residual drift is recovered via the next PR's drift guard +
          # RELEASE-RUNBOOK Failure mode 7 (the manual lockfile-only PR).
          if ! git_auth push "${remote}" HEAD:main; then
            echo "push rejected; rebasing on latest main and retrying once."
            git_auth pull --rebase "${remote}" main
            git_auth push "${remote}" HEAD:main
          fi
          echo "Pushed package-lock.json sync to main."

      - name: Surface failure pointer to release runbook
        # On failure OR in-progress cancellation, write a pointer to the runbook
        # into $GITHUB_STEP_SUMMARY so the on-call sees the recovery procedures
        # in the PR check UI rather than having to remember where the runbook
        # lives. cancelled() covers a mid-flight cancel (e.g. operator cancels
        # during `npm publish`) — it does NOT fire for an FM-6 env-approval
        # stall, since a job cancelled while still "Waiting for approval" never
        # runs any step. The runbook itself does not depend on this pointer for
        # FM-6 recovery.
        if: failure() || cancelled()
        shell: bash
        env:
          # Absolute URL — relative `../blob/main/...` from an Actions run page
          # would resolve to /<owner>/<repo>/actions/blob/main/... (404).
          RUNBOOK_URL: ${{ github.server_url }}/${{ github.repository }}/blob/main/docs/RELEASE-RUNBOOK.md
        run: |
          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
          ## Release job did not complete successfully

          See [\`docs/RELEASE-RUNBOOK.md\`](${RUNBOOK_URL}):
          - **FM-1** — First OIDC release fails (revert path)
          - **FM-2** — Sigstore unavailable (break-glass: \`NPM_CONFIG_PROVENANCE: 'false'\`)
          - **FM-3** — Partial publish (15-min timeout / mid-flow failure)
          - **FM-4** — Workflow / environment renamed
          - **FM-5** — Setup-script preflight refused to register bindings
          - **FM-6** — Env-approval stall

          Trust binding: \`{repo: ${{ github.repository }}, workflow: main.yaml, environment: npm-publish}\`.
          Tracking: SITES-42702.
          EOF