release-cli-stage.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: Stage CLI npm release

on:
  workflow_call:
    inputs:
      version:
        description: Exact maka-agent version from packages/cli/package.json
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: cli-npm-stage
  cancel-in-progress: false

jobs:
  authorize:
    name: Resolve product release
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      source_commit: ${{ steps.product.outputs.source_commit }}
      product_tag: ${{ steps.product.outputs.product_tag }}
    steps:
      - name: Check out the trusted publisher
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Require the Apache main publisher
        env:
          RELEASE_REF: ${{ github.ref }}
          RELEASE_REPOSITORY: ${{ github.repository }}
        run: |
          test "$RELEASE_REPOSITORY" = apache/maka
          test "$RELEASE_REF" = refs/heads/main

      - name: Check out the approved product source as data
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: v${{ inputs.version }}
          path: product-source
          fetch-depth: 1
          persist-credentials: false

      - name: Resolve the exact product release
        id: product
        env:
          GH_TOKEN: ${{ github.token }}
          PRODUCT_TAG: v${{ inputs.version }}
        run: |
          source_commit="$(git -C product-source rev-parse HEAD)"
          node scripts/product-release-authority.mjs verify-draft \
            "$PRODUCT_TAG" "$source_commit" "$GITHUB_REPOSITORY"
          echo "source_commit=$source_commit" >> "$GITHUB_OUTPUT"
          echo "product_tag=$PRODUCT_TAG" >> "$GITHUB_OUTPUT"

      - name: Verify the product release identity
        env:
          GITHUB_SHA: ${{ steps.product.outputs.source_commit }}
          EXPECTED_PRODUCT_VERSION: ${{ inputs.version }}
          PRODUCT_MANIFEST_ROOT: ${{ github.workspace }}/product-source
        run: node scripts/product-release-identity.mjs

  validate:
    name: Validate immutable candidate
    needs: authorize
    uses: ./.github/workflows/cli-package-validation.yml
    with:
      source_commit: ${{ needs.authorize.outputs.source_commit }}

  stage:
    name: Stage maka-agent on npm
    needs: [authorize, validate]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    environment:
      name: npm-publication
      url: https://www.npmjs.com/package/maka-agent
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Check out trusted staging code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22.19.0'
          registry-url: https://registry.npmjs.org
          package-manager-cache: false
      - name: Select the staged-publishing npm toolchain
        run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
      - name: Download the validated release candidate
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          artifact-ids: ${{ needs.validate.outputs.release_candidate_artifact_id }}
          path: packages/cli/release
      - name: Bind the candidate to this workflow run
        id: release
        env:
          EXPECTED_VERSION: ${{ inputs.version }}
          PRODUCT_TAG: ${{ needs.authorize.outputs.product_tag }}
          RELEASE_REPOSITORY: ${{ github.repository }}
          RELEASE_RUN_ID: ${{ github.run_id }}
          RELEASE_RUN_ATTEMPT: ${{ github.run_attempt }}
          PRODUCT_SOURCE_SHA: ${{ needs.authorize.outputs.source_commit }}
          PUBLISHER_SHA: ${{ github.sha }}
          RELEASE_WORKFLOW: .github/workflows/npm-publication.yml
        run: |
          node scripts/release-cli-publication.mjs prepare-stage \
            packages/cli/release \
            "$EXPECTED_VERSION" \
            "$PRODUCT_TAG" \
            "$PRODUCT_SOURCE_SHA" \
            "$PUBLISHER_SHA" \
            "$RELEASE_RUN_ID" \
            "$RELEASE_RUN_ATTEMPT" \
            "$RELEASE_REPOSITORY" \
            "$RELEASE_WORKFLOW" \
            "$GITHUB_OUTPUT"
      - name: Preserve the exact staged candidate
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cli-staged-release-${{ github.run_attempt }}
          path: |
            packages/cli/release/*.tgz
            packages/cli/release/*.tgz.sha256
            packages/cli/release/*.tgz.files.json
            packages/cli/release/release.json
          if-no-files-found: error
          compression-level: 0
          retention-days: 30
      - name: Record the post-staging approval step
        env:
          RELEASE_DIST_TAG: ${{ steps.release.outputs.dist_tag }}
          RELEASE_VERSION: ${{ steps.release.outputs.version }}
          RELEASE_RUN_ID: ${{ github.run_id }}
          RELEASE_RUN_ATTEMPT: ${{ github.run_attempt }}
        run: |
          {
            echo "## maka-agent@$RELEASE_VERSION staging"
            echo
            echo "After this workflow succeeds, review and approve the staged package with 2FA on npmjs.com."
            echo "After the package becomes public, run **Finalize product release** with:"
            echo
            echo "- stage run ID: \`$RELEASE_RUN_ID\`"
            echo "- stage run attempt: \`$RELEASE_RUN_ATTEMPT\`"
            echo "- version: \`$RELEASE_VERSION\`"
          } >> "$GITHUB_STEP_SUMMARY"
      - name: Submit the candidate to npm staging
        env:
          GH_TOKEN: ${{ github.token }}
          PREDECESSOR_VERSION: ${{ needs.validate.outputs.release_predecessor_version }}
          PREDECESSOR_TARBALL_URL: ${{ needs.validate.outputs.release_predecessor_tarball_url }}
          PREDECESSOR_INTEGRITY: ${{ needs.validate.outputs.release_predecessor_integrity }}
          PRODUCT_SOURCE_COMMIT: ${{ needs.authorize.outputs.source_commit }}
          PRODUCT_TAG: ${{ needs.authorize.outputs.product_tag }}
          RELEASE_DIST_TAG: ${{ steps.release.outputs.dist_tag }}
          RELEASE_TARBALL: ${{ steps.release.outputs.tarball }}
        run: |
          node scripts/release-cli-publication.mjs assert-nightly-predecessor \
            "$PREDECESSOR_VERSION" \
            "$PREDECESSOR_TARBALL_URL" \
            "$PREDECESSOR_INTEGRITY"

          node scripts/product-release-authority.mjs verify-draft \
            "$PRODUCT_TAG" "$PRODUCT_SOURCE_COMMIT" "$GITHUB_REPOSITORY"

          npm stage publish "$RELEASE_TARBALL" \
            --tag "$RELEASE_DIST_TAG" \
            --registry https://registry.npmjs.org/ \
            --provenance