npm-publish.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Publish npm packages

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to publish (e.g., 0.2.0)'
        required: true
        type: string
      dry-run:
        description: 'Dry run (skip actual publish)'
        required: false
        type: boolean
        default: false
  # IMPORTANT: Trusted publishing (OIDC) is configured on npmjs.com with
  # workflow filename 'CreateRelease.yml'. npm checks the *calling* workflow
  # for workflow_call, not the reusable workflow that runs npm publish.
  # Calling this workflow from a different parent workflow will fail OIDC auth.
  # See: https://docs.npmjs.com/trusted-publishers#troubleshooting
  workflow_call:
    inputs:
      version:
        description: 'Version to publish'
        required: true
        type: string
      dry-run:
        description: 'Dry run (skip actual publish)'
        required: false
        type: boolean
        default: false

permissions:
  contents: read
  id-token: write

concurrency:
  group: npm-publish-${{ inputs.version }}
  cancel-in-progress: false

env:
  WORKING_DIR: src/js-host-api

jobs:
  build:
    strategy:
      fail-fast: true
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: [self-hosted, Linux, X64, "1ES.Pool=hld-kvm-amd"]
            build_name: linux-x64-gnu
          - target: x86_64-unknown-linux-musl
            os: [self-hosted, Linux, X64, "1ES.Pool=hld-kvm-amd"]
            build_name: linux-x64-musl
          - target: x86_64-pc-windows-msvc
            os: [self-hosted, Windows, X64, "1ES.Pool=hld-win2025-amd"]
            build_name: win32-x64-msvc
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Hyperlight setup
        uses: hyperlight-dev/ci-setup-workflow@v1.9.0
        with:
          rust-toolchain: "1.89"

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: 'src/js-host-api/package-lock.json'

      - name: Install dependencies
        working-directory: ${{ env.WORKING_DIR }}
        run: npm ci --ignore-scripts --omit=optional

      - name: Set package version
        working-directory: ${{ env.WORKING_DIR }}
        run: npm version "${{ inputs.version }}" --no-git-tag-version --allow-same-version

      - name: Install musl tools
        if: contains(matrix.target, 'musl')
        run: sudo apt-get update && sudo apt-get install -y musl-tools

      - name: Add musl Rust target
        if: contains(matrix.target, 'musl')
        run: rustup target add x86_64-unknown-linux-musl

      - name: Build native module
        working-directory: ${{ env.WORKING_DIR }}
        run: npm run build -- --target ${{ matrix.target }}

      - name: Upload native binary
        uses: actions/upload-artifact@v7
        with:
          name: bindings-${{ matrix.build_name }}
          path: ${{ env.WORKING_DIR }}/*.node
          if-no-files-found: error

      # index.js and index.d.ts are generated by napi build and are
      # platform-independent, so we only need to upload them once.
      - name: Upload JS bindings
        if: matrix.build_name == 'linux-x64-gnu'
        uses: actions/upload-artifact@v7
        with:
          name: js-bindings
          path: |
            ${{ env.WORKING_DIR }}/index.js
            ${{ env.WORKING_DIR }}/index.d.ts
          if-no-files-found: error

  publish:
    needs: build
    # Trusted publishing (OIDC) requires GitHub-hosted runners.
    # The publish job only downloads pre-built artifacts and runs npm publish,
    # so it does not need self-hosted runners with KVM/Hyperlight.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '22'
          registry-url: 'https://registry.npmjs.org'
          cache: 'npm'
          cache-dependency-path: 'src/js-host-api/package-lock.json'

      # Trusted publishing requires npm 11.5.1+ (Node 22 ships with npm 10.x)
      - name: Upgrade npm for trusted publishing
        run: npm install -g npm@11 && npm --version

      - name: Validate version format
        run: npx --yes semver "$VERSION"
        env:
          VERSION: ${{ inputs.version }}

      - name: Install dependencies
        working-directory: ${{ env.WORKING_DIR }}
        run: npm ci --ignore-scripts --omit=optional

      - name: Download Linux GNU artifact
        uses: actions/download-artifact@v8
        with:
          name: bindings-linux-x64-gnu
          path: ${{ env.WORKING_DIR }}/artifacts/linux-x64-gnu

      - name: Download Linux musl artifact
        uses: actions/download-artifact@v8
        with:
          name: bindings-linux-x64-musl
          path: ${{ env.WORKING_DIR }}/artifacts/linux-x64-musl

      - name: Download Windows artifact
        uses: actions/download-artifact@v8
        with:
          name: bindings-win32-x64-msvc
          path: ${{ env.WORKING_DIR }}/artifacts/win32-x64-msvc

      - name: Download JS bindings
        uses: actions/download-artifact@v8
        with:
          name: js-bindings
          path: ${{ env.WORKING_DIR }}/js-bindings

      - name: List artifacts
        run: ls -la ${{ env.WORKING_DIR }}/artifacts/*/

      - name: Move artifacts to npm directories
        working-directory: ${{ env.WORKING_DIR }}
        run: |
          # Rename artifacts to match napi-rs naming convention
          mv artifacts/linux-x64-gnu/*.node npm/linux-x64-gnu/js-host-api.linux-x64-gnu.node
          mv artifacts/linux-x64-musl/*.node npm/linux-x64-musl/js-host-api.linux-x64-musl.node
          mv artifacts/win32-x64-msvc/*.node npm/win32-x64-msvc/js-host-api.win32-x64-msvc.node
          ls -la npm/linux-x64-gnu/
          ls -la npm/linux-x64-musl/
          ls -la npm/win32-x64-msvc/

      - name: Set package versions
        working-directory: ${{ env.WORKING_DIR }}
        run: |
          # Update main package version
          npm version "$VERSION" --no-git-tag-version --allow-same-version
          
          # Update platform package versions
          cd npm/linux-x64-gnu && npm version "$VERSION" --no-git-tag-version --allow-same-version
          cd ../linux-x64-musl && npm version "$VERSION" --no-git-tag-version --allow-same-version
          cd ../win32-x64-msvc && npm version "$VERSION" --no-git-tag-version --allow-same-version
        env:
          VERSION: ${{ inputs.version }}

      - name: Update optionalDependencies versions
        working-directory: ${{ env.WORKING_DIR }}
        run: |
          # Update only @hyperlight platform package versions (not other optionalDeps)
          node -e "
            const fs = require('fs');
            const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
            for (const dep of Object.keys(pkg.optionalDependencies || {})) {
              if (dep.startsWith('@hyperlight-dev/js-host-api-')) {
                pkg.optionalDependencies[dep] = process.env.VERSION;
              }
            }
            fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
          "
          cat package.json
        env:
          VERSION: ${{ inputs.version }}

      - name: Install JS bindings (index.js and index.d.ts)
        working-directory: ${{ env.WORKING_DIR }}
        run: |
          # index.js and index.d.ts are generated by napi build and uploaded
          # from the linux-x64-gnu build job.
          ls -la js-bindings/
          mv js-bindings/index.js index.js
          mv js-bindings/index.d.ts index.d.ts
          ls -la index.js index.d.ts

      - name: Validate packages
        working-directory: ${{ env.WORKING_DIR }}
        run: ./test-pack.sh

      # ── Authentication strategy ────────────────────────────────────
      # Production releases via CreateRelease.yml use trusted publishing
      # (OIDC) — npm auto-detects the id-token and exchanges it for a
      # short-lived publish credential. Provenance attestations are
      # generated automatically. The --provenance flag is added explicitly
      # so the build fails loudly if OIDC is misconfigured.
      #
      # Manual workflow_dispatch requires an NPM_TOKEN repo secret because
      # trusted publishing is configured for CreateRelease.yml only.
      # Provenance is NOT available for token-based publishing.
      # You should almost never need to publish manually — if you do,
      # see docs/release.md for the full (deliberately painful) steps.
      - name: Validate NPM_TOKEN for manual dispatch
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs['dry-run'] }}
        run: |
          if [ -z "$NPM_TOKEN" ]; then
            echo "::error::NPM_TOKEN repo secret is required for manual workflow_dispatch publishing."
            echo "::error::See docs/release.md 'Manual npm publishing (emergency only)' for instructions."
            exit 1
          fi
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

      # Set provenance flag once — OIDC path gets --provenance (fails loud
      # if misconfigured), token path skips it (not supported).
      - name: Set publish flags
        id: publish-flags
        run: |
          if [ "${{ github.event_name }}" != "workflow_dispatch" ]; then
            echo "provenance=--provenance" >> "$GITHUB_OUTPUT"
          else
            echo "provenance=" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish Linux GNU package
        if: ${{ !inputs['dry-run'] }}
        working-directory: ${{ env.WORKING_DIR }}/npm/linux-x64-gnu
        run: npm publish --access public --ignore-scripts ${{ steps.publish-flags.outputs.provenance }}
        env:
          NODE_AUTH_TOKEN: ${{ github.event_name == 'workflow_dispatch' && secrets.NPM_TOKEN || '' }}

      - name: Publish Linux musl package
        if: ${{ !inputs['dry-run'] }}
        working-directory: ${{ env.WORKING_DIR }}/npm/linux-x64-musl
        run: npm publish --access public --ignore-scripts ${{ steps.publish-flags.outputs.provenance }}
        env:
          NODE_AUTH_TOKEN: ${{ github.event_name == 'workflow_dispatch' && secrets.NPM_TOKEN || '' }}

      - name: Publish Windows package
        if: ${{ !inputs['dry-run'] }}
        working-directory: ${{ env.WORKING_DIR }}/npm/win32-x64-msvc
        run: npm publish --access public --ignore-scripts ${{ steps.publish-flags.outputs.provenance }}
        env:
          NODE_AUTH_TOKEN: ${{ github.event_name == 'workflow_dispatch' && secrets.NPM_TOKEN || '' }}

      - name: Publish main package
        if: ${{ !inputs['dry-run'] }}
        working-directory: ${{ env.WORKING_DIR }}
        run: npm publish --access public --ignore-scripts ${{ steps.publish-flags.outputs.provenance }}
        env:
          NODE_AUTH_TOKEN: ${{ github.event_name == 'workflow_dispatch' && secrets.NPM_TOKEN || '' }}

      - name: Verify all packages published
        if: ${{ !inputs['dry-run'] }}
        run: |
          echo "Waiting for registry propagation..."
          sleep 15
          FAILED=0
          for pkg in "@hyperlight-dev/js-host-api" \
                     "@hyperlight-dev/js-host-api-linux-x64-gnu" \
                     "@hyperlight-dev/js-host-api-linux-x64-musl" \
                     "@hyperlight-dev/js-host-api-win32-x64-msvc"; do
            if npm view "$pkg@$VERSION" version > /dev/null 2>&1; then
              echo "✅ $pkg@$VERSION published"
            else
              echo "::error::❌ $pkg@$VERSION NOT found on registry!"
              FAILED=1
            fi
          done
          if [ "$FAILED" -eq 1 ]; then
            echo "::error::Some packages failed to publish. Check above for details."
            exit 1
          fi
        env:
          VERSION: ${{ inputs.version }}

      - name: Dry run - show what would be published
        if: ${{ inputs['dry-run'] }}
        working-directory: ${{ env.WORKING_DIR }}
        run: |
          echo "=== DRY RUN - Would publish the following packages ==="
          echo ""
          echo "--- @hyperlight-dev/js-host-api-linux-x64-gnu ---"
          npm pack ./npm/linux-x64-gnu --dry-run
          echo ""
          echo "--- @hyperlight-dev/js-host-api-linux-x64-musl ---"
          npm pack ./npm/linux-x64-musl --dry-run
          echo ""
          echo "--- @hyperlight-dev/js-host-api-win32-x64-msvc ---"
          npm pack ./npm/win32-x64-msvc --dry-run
          echo ""
          echo "--- @hyperlight-dev/js-host-api ---"
          npm pack --dry-run