npmPublish.yml

on:
  workflow_call:
    secrets:
      NPM_TOKEN:
        description: npm token
      AWS_ACCESS_KEY_ID:
        description: AWS access key id. Only required if sign = true
      AWS_SECRET_ACCESS_KEY:
        description: AWS secret access key. Only required if sign = true

    inputs:
      tag:
        required: false
        description: tag used to publish to npm
        default: latest
        type: string
      sign:
        required: false
        description: signs the package using sf-release if set to true
        default: false
        type: boolean
      dryrun:
        required: false
        description: if true, the job will run but will not publish to npm or push to git
        default: false
        type: boolean
      prerelease:
        required: false
        description: if true, it will use the version <version>-<branch>.0
        type: boolean
        default: false
      nodeVersion:
        description: version of node to use.  It's better to specify latest, lts/* or lts/-1 than to hardode numbers
        type: string
        default: lts/*
        required: false
      ctc:
        description: |
          Use CTC.  Requires environment to contain
          SF_CHANGE_CASE_SFDX_AUTH_URL, SF_CHANGE_CASE_TEMPLATE_ID, SF_CHANGE_CASE_CONFIGURATION_ITEM.
          Also requires a static ip runner (you can't use ubuntu-latest)
        type: boolean
        required: false
      runsOn:
        description: the runner.  Only needed if you need a non-public runner (ex, for git checkout from IP restricted private repo)
        default: ubuntu-latest
        required: false
        type: string
      githubTag:
        description: the github release tag that you want to publish as an npm package
        required: true
        type: string
      packageManager:
        description: the package manager to use.  Defaults to yarn, but can be set to npm
        required: false
        default: yarn
        type: string
      vulnerabilityCheck:
        description: if true, checks for known vulnerable package versions
        required: false
        default: true
        type: boolean
jobs:
  check-publish:
    outputs:
      published: ${{ steps.is-published.outputs.published }}
    runs-on: ubuntu-latest
    env:
      INPUTS_GITHUB_TAG: ${{ inputs.githubTag }}
      INPUTS_PACKAGE_MANAGER: ${{ inputs.packageManager }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.githubTag }}
      - name: Validate package manager
        run: |
          if [[ "$INPUTS_PACKAGE_MANAGER" != "yarn" && "$INPUTS_PACKAGE_MANAGER" != "npm" ]]; then
            echo "Error: packageManager must be 'yarn' or 'npm', got '$INPUTS_PACKAGE_MANAGER'"
            exit 1
          fi
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.nodeVersion }}

      - name: Is published
        id: is-published
        run: |
          RESPONSE=$(npm view .@$INPUTS_GITHUB_TAG version --json --silent || echo "Not published")

          # The response is wrapped in double quotes, so we need to compare it with (escaped) quotes
          if [ "$RESPONSE" = "\"$INPUTS_GITHUB_TAG\"" ]; then
            echo "published=true" >> "$GITHUB_OUTPUT"
          else
            echo "published=false" >> "$GITHUB_OUTPUT"
          fi
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - run: echo "[INFO] Is package published:\ $STEPS_IS_PUBLISHED_PUBLISHED"
        env:
          STEPS_IS_PUBLISHED_PUBLISHED: ${{ steps.is-published.outputs.published }}

      - name: Fail if published
        if: steps.is-published.outputs.published == 'true'
        uses: actions/github-script@v7
        with:
          script: core.setFailed(`The version '${process.env.INPUTS_GITHUB_TAG}' has already been published to npm`)

  ctc-open:
    needs: [check-publish]
    if: inputs.ctc && needs.check-publish.outputs.published == 'false'
    uses: salesforcecli/github-workflows/.github/workflows/ctcOpen.yml@main
    with:
      githubTag: ${{ inputs.githubTag }}
    secrets: inherit

  npm-publish:
    needs: [check-publish, ctc-open]
    if: ${{ always() && needs.check-publish.outputs.published == 'false' && (!inputs.ctc || (inputs.ctc && needs.ctc-open.outputs.changeCaseId)) }}
    runs-on: ${{ inputs.runsOn }}
    env:
      INPUTS_PACKAGE_MANAGER: ${{ inputs.packageManager }}
      INPUTS_GITHUB_TAG: ${{ inputs.githubTag }}
      INPUTS_TAG: ${{ inputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.githubTag }}
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.nodeVersion }}
          cache: ${{ inputs.packageManager }}
      - name: Install dependencies with yarn
        if: inputs.packageManager == 'yarn'
        uses: salesforcecli/github-workflows/.github/actions/yarnInstallWithRetries@main
      - name: Install dependencies with npm
        if: inputs.packageManager == 'npm'
        uses: salesforcecli/github-workflows/.github/actions/npmInstallWithRetries@main
      - name: Vulnerability check
        if: inputs.vulnerabilityCheck
        # Temporary check for known vulnerable packages from the following supply chain attack:
        # https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack
        # Last updated 10:33 a.m. ET on September 9, 2025
        run: |
          vulns=(
            "@coveops/abi@2.0.1"
            "@duckdb/duckdb-wasm@1.29.2"
            "@duckdb/node-api@1.3.3"
            "@duckdb/node-bindings@1.3.3"
            "ansi-regex@6.2.1"
            "ansi-styles@6.2.2"
            "backslash@0.2.1"
            "chalk@5.6.1"
            "chalk-template@1.1.1"
            "color@5.0.1"
            "color-convert@3.1.1"
            "color-name@2.0.1"
            "color-string@2.1.1"
            "debug@4.4.2"
            "duckdb@1.3.3"
            "error-ex@1.3.3"
            "has-ansi@6.0.1"
            "is-arrayish@0.3.3"
            "prebid@10.9.2"
            "prebid-universal-creative@1.17.3"
            "prebid.js@10.9.2"
            "proto-tinker-wc@0.1.87"
            "simple-swizzle@0.2.3"
            "slice-ansi@7.1.1"
            "strip-ansi@7.1.1"
            "supports-color@10.2.1"
            "supports-hyperlinks@4.1.1"
            "wrap-ansi@9.0.1"
          )

          for vuln in "${vulns[@]}"; do
            if [[ -n $(npm ls --depth=99 --parseable "$vuln") ]]; then
              echo "VULNERABILITY FOUND: $vuln"
              exit 1
            else
              echo "Known vulnerability not found: $vuln"
            fi
          done

          # Known string from the exploit
          # https://github.com/chalk/chalk/issues/656#issuecomment-3266880534
          strings=(
            "_0x112fa8"
          )

          for str in "${strings[@]}"; do
            if grep -r "$str" --include='*.js' .; then
              echo "VULNERABILITY FOUND: string '$str' found in js files"
              exit 1
            else
              echo "String '$str' not found in js files"
            fi
          done
      - run: $INPUTS_PACKAGE_MANAGER run build
      - run: npm install -g @salesforce/plugin-release-management
      - name: NPM Release
        run: |
          sf-release npm:package:release \
            --githubtag "$INPUTS_GITHUB_TAG" \
            --npmtag "$INPUTS_TAG" \
            --no-install \
            ${{ inputs.dryrun && '--dryrun' || '' }} \
            ${{ inputs.prerelease && format('--prerelease {0}', github.ref_name) || '' }} \
            ${{ inputs.sign && '--sign' || '' }}
        env:
          NPM_TOKEN: ${{secrets.NPM_TOKEN}}
          AWS_ACCESS_KEY_ID: ${{secrets.AWS_ACCESS_KEY_ID}}
          AWS_SECRET_ACCESS_KEY: ${{secrets.AWS_SECRET_ACCESS_KEY}}

  ctcCloseSuccess:
    needs: [ctc-open, npm-publish]
    if: needs.ctc-open.result == 'success' && needs.npm-publish.result == 'success' && needs.ctc-open.outputs.changeCaseId
    uses: salesforcecli/github-workflows/.github/workflows/ctcClose.yml@main
    secrets: inherit
    with:
      changeCaseId: ${{needs.ctc-open.outputs.changeCaseId}}

  ctcCloseFail:
    needs: [ctc-open, npm-publish]
    if: always() && inputs.ctc && needs.ctc-open.outputs.changeCaseId && (needs.ctc-open.result != 'success' || needs.npm-publish.result != 'success')
    uses: salesforcecli/github-workflows/.github/workflows/ctcClose.yml@main
    secrets: inherit
    with:
      changeCaseId: ${{ needs.ctc-open.outputs.changeCaseId }}
      status: Not Implemented