build: modfying publish action to use npm cli to include provenance i…

…n npm publish (#319) **Requirements** - [ ] I have added test coverage for new or changed functionality - [ ] I have followed the repository's [pull request submission guidelines](../blob/main/CONTRIBUTING.md#submitting-pull-requests) - [ ] I have validated my changes against all supported platform versions **Related issues** **Describe the solution you've provided** Yarn publish doesn't currently support NPM's publish package with provenance functionality. As a workaround until this is supported, we'll pack the workspace with yarn in order to guarantee we get the same package as before, and then use the npm cli to do the final publish with provenance. This also involves passing the workspace path as input parameters to the publish actions/script as npm's workspace functionality doesn't work exactly the same as yarns. While npm's generated provenance isn't the most robust provenance attestation, it results in a verified checkmark on the npm package page, which brings the provenance closest to the consumer and makes it most useful. **Describe alternatives you've considered** Ideally we'd want yarn to support this natively, but tracking the yarn repo issues for the past couple months has shown no movement here. **Additional context** Add any other context about the pull request here.
launchdarkly · Dec 7, 2023 · 78aac46 · 78aac46
2 parents d975526 + a8e5337
commit 78aac46
Show file tree

Hide file tree

Showing 6 changed files with 61 additions and 3 deletions.
diff --git a/.github/workflows/manual-publish.yml b/.github/workflows/manual-publish.yml
@@ -41,6 +41,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - name: 'Setup Redis'
         if: ${{ inputs.workspace_path == 'packages/store/node-server-sdk-redis' }}
         run: |
@@ -80,5 +83,6 @@ jobs:
         uses: ./actions/publish
         with:
           workspace_name: ${{ env.WORKSPACE_NAME }}
+          workspace_path: ${{ inputs.workspace_path }}
           prerelease: ${{ inputs.prerelease }}
           dry_run: ${{ inputs.dry_run }}
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
@@ -40,6 +40,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/shared/common
         uses: ./actions/full-release
@@ -60,6 +63,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/shared/sdk-server
         uses: ./actions/full-release
@@ -80,6 +86,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/shared/sdk-server-edge
         uses: ./actions/full-release
@@ -100,6 +109,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/shared/akamai-edgeworker-sdk
         uses: ./actions/full-release
@@ -120,6 +132,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/cloudflare
         uses: ./actions/full-release
@@ -140,6 +155,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/server-node
         uses: ./actions/full-release
@@ -160,6 +178,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/vercel
         uses: ./actions/full-release
@@ -180,6 +201,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/akamai-base
         uses: ./actions/full-release
@@ -200,6 +224,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - id: release-common
         name: Full release of packages/sdk/akamai-edgekv
         uses: ./actions/full-release
@@ -220,6 +247,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - run: |
           sudo apt-get update
           sudo apt-get install redis-server
@@ -244,6 +274,9 @@ jobs:
         with:
           node-version: 16.x
           registry-url: 'https://registry.npmjs.org'
+      - uses: ./actions/install-npm-version
+        with: 
+          npm_version: 9.5.0
       - run: |
           sudo docker run -d -p 8000:8000 amazon/dynamodb-local
       - id: release-common

diff --git a/actions/full-release/action.yml b/actions/full-release/action.yml
@@ -34,6 +34,7 @@ runs:
     - uses: ./actions/publish
       with:
         workspace_name: ${{ env.WORKSPACE_NAME }}
+        workspace_path: ${{ inputs.workspace_path }}
         prerelease: false
         dry_run: false
     - uses: ./actions/publish-docs

diff --git a/actions/install-npm-version/action.yml b/actions/install-npm-version/action.yml
@@ -0,0 +1,16 @@
+name: Install npm version
+# Used to specify a version of npm that supports --provenance (for node installs < 18.X)
+description: Install the latest version of the npm CLI utility. 
+inputs:
+  npm_version:
+    description: 'The version of npm to install'
+    required: false
+    default: latest
+
+runs:
+  using: composite
+  steps:
+    - name: 'Install specified npm version'
+      shell: bash
+      run: |
+        npm install -g npm@${{ inputs.npm_version }}
diff --git a/actions/publish/action.yml b/actions/publish/action.yml
@@ -4,6 +4,9 @@ inputs:
   workspace_name:
     description: 'The workspace to publish'
     required: true
+  workspace_path:
+    description: 'Path to the workspace (for npm publish)'
+    required: true
   prerelease:
     description: 'Is this a prerelease. If so, then the latest tag will not be updated in npm.'
     required: true
@@ -21,5 +24,6 @@ runs:
         ./scripts/publish.sh
       env:
         WORKSPACE: ${{ inputs.workspace_name }}
+        WORKSPACE_PATH: ${{ inputs.workspace_path }}
         LD_RELEASE_IS_PRERELEASE: ${{ inputs.prerelease }}
         LD_RELEASE_IS_DRYRUN: ${{ inputs.dry_run }}
diff --git a/scripts/publish.sh b/scripts/publish.sh
@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
+yarn workspace $WORKSPACE pack
 if $LD_RELEASE_IS_DRYRUN ; then
   # Dry run just pack the workspace.
   echo "Doing a dry run of publishing."
-  yarn workspace $WORKSPACE pack
 else
   if $LD_RELEASE_IS_PRERELEASE ; then
     echo "Publishing with prerelease tag."
-    yarn workspace $WORKSPACE npm publish --tag prerelease || { echo "npm publish failed" >&2; exit 1; }
+    npm publish --tag prerelease --provenance --access public "./$WORKSPACE_PATH/package.tgz" || { echo "npm publish failed" >&2; exit 1; }
   else
-    yarn workspace $WORKSPACE npm publish || { echo "npm publish failed" >&2; exit 1; }
+    npm publish --provenance --access public "./$WORKSPACE_PATH/package.tgz" || { echo "npm publish failed" >&2; exit 1; }
   fi
 fi