node-release.yml

name: node-release

on:
  push:
    tags:
      - "npm-v*"

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs:
  verify:
    if: github.repository == 'openai/codex-security'
    name: verify
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      NPM_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
      PNPM_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
      COREPACK_NPM_REGISTRY: https://openai.firewall.socket.dev/npm/
      BUN_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
    outputs:
      artifact-id: ${{ steps.upload.outputs.artifact-id }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Socket Firewall
        uses: SocketDev/action@937f824ec476dfd164d4a4d9995751427b0be143 # v1
        with:
          mode: firewall-free
          firewall-version: "1.15.0"

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: "22"
          package-manager-cache: false

      - name: Activate Socket Firewall
        shell: bash
        run: |
          set -euo pipefail

          npm_registry="https://openai.firewall.socket.dev/npm/"
          pypi_registry="https://openai.firewall.socket.dev/pypi/simple/"
          {
            printf 'NPM_CONFIG_REGISTRY=%s\n' "$npm_registry"
            printf 'npm_config_registry=%s\n' "$npm_registry"
            printf 'PNPM_CONFIG_REGISTRY=%s\n' "$npm_registry"
            printf 'pnpm_config_registry=%s\n' "$npm_registry"
            printf 'COREPACK_NPM_REGISTRY=%s\n' "$npm_registry"
            printf 'YARN_NPM_REGISTRY_SERVER=%s\n' "$npm_registry"
            printf 'BUN_CONFIG_REGISTRY=%s\n' "$npm_registry"
            printf 'UV_DEFAULT_INDEX=%s\n' "$pypi_registry"
            printf 'UV_INDEX_URL=%s\n' "$pypi_registry"
            printf 'PIP_INDEX_URL=%s\n' "$pypi_registry"
          } >> "$GITHUB_ENV"

      - name: Set up Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: "1.3.14"
          no-cache: true

      - name: Enable pnpm
        shell: bash
        run: corepack enable && corepack prepare "$(node -p 'require("./sdk/typescript/package.json").packageManager')" --activate

      - name: Validate release tag
        id: release
        shell: bash
        run: |
          set -euo pipefail
          if [[ ! "$GITHUB_REF_NAME" =~ ^npm-v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo "npm release tags must identify a stable release, such as npm-v0.1.0." >&2
            exit 1
          fi
          version="${GITHUB_REF_NAME#npm-v}"
          package_version="$(node -p 'require("./sdk/typescript/package.json").version')"
          if [[ "$version" != "$package_version" ]]; then
            echo "npm release tag $version must match package version $package_version." >&2
            exit 1
          fi
          git fetch origin main
          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
            echo "npm release tags must point to a commit on main." >&2
            exit 1
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Install dependencies
        run: sfw pnpm --dir sdk/typescript install --frozen-lockfile

      - name: Audit production dependencies
        run: sfw pnpm --dir sdk/typescript run audit:prod

      - name: Verify
        run: |
          pnpm --dir sdk/typescript run types
          pnpm --dir sdk/typescript run test
          pnpm --dir sdk/typescript run format
          pnpm --dir sdk/typescript run build

      - name: Pack
        working-directory: sdk/typescript
        shell: bash
        run: |
          set -euo pipefail
          npm pkg set "gitHead=$GITHUB_SHA"
          pnpm pack --pack-destination ../../dist

      - name: Inspect package
        working-directory: sdk/typescript
        shell: bash
        env:
          CODEX_SECURITY_EXPECTED_GIT_HEAD: ${{ github.sha }}
        run: pnpm run check:package ../../dist/*.tgz

      - name: Smoke test package
        shell: bash
        run: |
          set -euo pipefail
          consumer="$(mktemp -d)"
          trap 'rm -rf "$consumer"' EXIT
          printf '%s\n' '{"name":"codex-security-smoke","private":true,"type":"module"}' > "$consumer/package.json"
          sfw npm install --ignore-scripts --prefix "$consumer" --include=optional --no-audit --no-fund ./dist/*.tgz
          (cd "$consumer" && node --input-type=module --eval 'const sdk = await import("@openai/codex-security"); if (typeof sdk.CodexSecurity !== "function") process.exit(1);')
          "$consumer/node_modules/.bin/codex-security" --version
          "$consumer/node_modules/.bin/codex-security" --help

      - name: Upload verified package
        id: upload
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: npm-release-tarball
          path: dist/*.tgz
          if-no-files-found: error
          retention-days: 30
          compression-level: 0

  publish:
    if: github.repository == 'openai/codex-security'
    name: publish
    needs: verify
    runs-on: ubuntu-latest
    environment: npm
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
          package-manager-cache: false

      - name: Verify bundled trusted-publishing npm
        shell: bash
        run: |
          set -euo pipefail
          node --eval '
            const version = process.argv[1];
            const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
            const [major, minor, patch] = match?.slice(1).map(Number) ?? [];
            if (
              !match ||
              major < 11 ||
              (major === 11 && (minor < 5 || (minor === 5 && patch < 1)))
            ) {
              console.error(
                "npm 11.5.1 or newer is required for trusted publishing; found " +
                  version +
                  ".",
              );
              process.exit(1);
            }
          ' "$(npm --version)"

      - name: Download verified package
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          artifact-ids: ${{ needs.verify.outputs.artifact-id }}
          path: dist
          merge-multiple: true
          digest-mismatch: error

      - name: Publish initial npm release
        if: github.ref_name == 'npm-v0.1.0'
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_FIRST_PUBLISH_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${NODE_AUTH_TOKEN:-}" ]]; then
            echo "Security Products must configure NPM_FIRST_PUBLISH_TOKEN in the protected npm environment before the initial release." >&2
            exit 1
          fi
          npm publish ./dist/*.tgz --provenance --access public --tag latest

      - name: Publish to npm using trusted publishing
        if: github.ref_name != 'npm-v0.1.0'
        run: npm publish ./dist/*.tgz --provenance --access public --tag latest