Repository navigation
ci: add manual workflow to publish npm packages to DrumWave CodeArtifact #1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
e686f3b
ci: add manual workflow to publish npm packages to DrumWave CodeArtifact
jyothsna-m7 bf6c58b
fix: address CodeRabbit review — pin actions, least-privilege perms, …
jyothsna-m7 d8662c3
fix: bump golang.org/x/crypto to v0.55.0, fixing CVE-2026-56854
jyothsna-m7 42ca47b
fix(codeartifact): publish under @drumwave scope instead of upstream …
jyothsna-m7 d63e9fc
docs(codeartifact): document accepted shared-role privilege tradeoff
jyothsna-m7 8a8fd55
fix(ci): disable upstream's tag-triggered public npm publish step
jyothsna-m7 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,169 @@ | ||
| # Publishes this fork's dbmate npm packages to DrumWave's private CodeArtifact | ||
| # repository instead of the public npm registry. Mirrors the OIDC -> codeartifact | ||
| # login -> npm publish pattern marketplace.monorepo's own sdk-publish.yaml uses | ||
| # for @drumwave/mp-internal-sdk / @drumwave/mp-sdk. | ||
| # | ||
| # Published under the @drumwave scope (@drumwave/dbmate, @drumwave/dbmate-<platform>) | ||
| # rather than the upstream public names (dbmate, @dbmate/<platform>). Publishing | ||
| # under the same names CodeArtifact already proxies from npmjs.org would mean | ||
| # permanently relaxing origin-control on common-library-npm -- a repo shared with | ||
| # every other internal package -- and with upstream still reachable, a real dbmate | ||
| # release could silently take precedence over this patched build later (prerelease | ||
| # versions don't win an ordinary semver range against it). Scoping to @drumwave | ||
| # sidesteps both: the name was never fetched from upstream, so no origin-control | ||
| # change is needed at all. | ||
| # | ||
| # Trigger: manual only, via workflow_dispatch. Kept separate from ci.yml's | ||
| # `v*` tag trigger so this never collides with (or accidentally piggybacks on) | ||
| # the upstream public-npm release flow. Run it after bumping | ||
| # pkg/dbmate/version.go to a version string that doesn't exist upstream, e.g. | ||
| # "2.35.1-drumwave.1". | ||
| name: Publish to CodeArtifact | ||
|
|
||
| on: | ||
| workflow_dispatch: {} | ||
|
|
||
| jobs: | ||
| build: | ||
| permissions: | ||
| contents: read | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - os: linux | ||
| image: ubuntu-latest | ||
| arch: 386 | ||
| setup: sudo apt-get update && sudo apt-get install -qq gcc-i686-linux-gnu | ||
| env: | ||
| CC: i686-linux-gnu-gcc | ||
| CXX: i686-linux-gnu-g++ | ||
| - os: linux | ||
| image: ubuntu-latest | ||
| arch: amd64 | ||
| env: {} | ||
| - os: linux | ||
| image: ubuntu-latest | ||
| arch: arm | ||
| setup: sudo apt-get update && sudo apt-get install -qq gcc-arm-linux-gnueabi | ||
| env: | ||
| CC: arm-linux-gnueabi-gcc | ||
| CXX: arm-linux-gnueabi-g++ | ||
| GOARM: 6 | ||
| - os: linux | ||
| image: ubuntu-latest | ||
| arch: arm64 | ||
| setup: sudo apt-get update && sudo apt-get install -qq gcc-aarch64-linux-gnu | ||
| env: | ||
| CC: aarch64-linux-gnu-gcc | ||
| CXX: aarch64-linux-gnu-g++ | ||
| - os: macos | ||
| image: macos-latest | ||
| arch: amd64 | ||
| env: {} | ||
| - os: macos | ||
| image: macos-latest | ||
| arch: arm64 | ||
| env: {} | ||
| - os: windows | ||
| image: windows-latest | ||
| arch: amd64 | ||
| setup: choco install sqlite | ||
| env: {} | ||
| name: Build (${{ matrix.os }}/${{ matrix.arch }}) | ||
| runs-on: ${{ matrix.image }} | ||
| env: ${{ matrix.env }} | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | ||
| with: | ||
| persist-credentials: false | ||
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 | ||
| with: | ||
| go-version-file: go.mod | ||
| - name: Setup environment | ||
| run: ${{ matrix.setup }} | ||
| - run: go mod download | ||
| - run: make build ls | ||
| env: | ||
| GOARCH: ${{ matrix.arch }} | ||
| OUTPUT: dbmate-${{ matrix.os }}-${{ matrix.arch }} | ||
| - name: Upload build artifacts | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | ||
| with: | ||
| name: dbmate-${{ matrix.os }}-${{ matrix.arch }} | ||
| path: dist/dbmate-* | ||
|
|
||
| publish: | ||
| name: Publish npm packages to CodeArtifact | ||
| runs-on: ubuntu-latest | ||
| needs: build | ||
| permissions: | ||
| id-token: write # AWS OIDC | ||
| contents: read | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - run: corepack enable | ||
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 | ||
| with: | ||
| node-version: 20 | ||
| cache: npm | ||
| cache-dependency-path: typescript/package-lock.json | ||
|
|
||
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | ||
| with: | ||
| path: dist | ||
|
|
||
| - run: npm ci | ||
| working-directory: typescript | ||
| - run: npm run generate | ||
| working-directory: typescript | ||
| - run: npm test | ||
| working-directory: typescript | ||
|
|
||
| # Same role/domain/repository sdk-publish.yaml uses in marketplace.monorepo. | ||
| # Confirmed with the SRE team directly: the role's trust policy already | ||
| # accepts any reddrummer/* repo (org-wide wildcard subject) and it has | ||
| # AWSCodeArtifactAdminAccess attached, so no IAM changes were needed here. | ||
|
jyothsna-m7 marked this conversation as resolved.
|
||
| # | ||
| # Known tradeoff, accepted for now (see PR #1 review): this is a shared, | ||
| # org-wide-trusted role with admin-level CodeArtifact access, so any | ||
| # reddrummer/* repo's CI can already modify anything in common-library-npm, | ||
| # not just this repo's packages. marketplace.monorepo's sdk-publish.yaml | ||
| # depends on this same shared role, so narrowing its trust to just | ||
| # reddrummer/dbmate isn't an option here -- a properly-scoped fix would | ||
| # mean giving dbmate its own dedicated OIDC role instead (the per-repo | ||
| # actions-role pattern offers-service/pricing-service/dw-notify already | ||
| # use), which is a separate Terraform PR against sre.infrastructure. | ||
| - name: Configure AWS credentials | ||
| uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6 | ||
| with: | ||
| role-to-assume: arn:aws:iam::127266044500:role/reddrummer-github-actions-runner | ||
| aws-region: us-east-1 | ||
| role-session-name: GitHubActions-CodeArtifact-Publish | ||
|
|
||
| - name: Login npm to CodeArtifact | ||
| run: | | ||
| aws codeartifact login --tool npm \ | ||
| --domain drumwave-prod \ | ||
| --domain-owner 127266044500 \ | ||
| --repository common-library-npm \ | ||
| --region us-east-1 | ||
|
|
||
| # publish.ts hardcodes --provenance (npm's OIDC trusted-publish flow, | ||
| # npmjs.org-only) and no --registry (implicit npmjs.org default) -- both | ||
| # wrong for a private registry, so this loop reimplements its two lines | ||
| # of real logic against CodeArtifact instead of calling `npm run publish`. | ||
| # | ||
| # No CodeArtifact origin-control step is needed here: these publish as | ||
| # @drumwave/dbmate and @drumwave/dbmate-<platform>, names never fetched | ||
| # from npmjs.org, so origin-control never blocks them. | ||
| - name: Publish packages | ||
| working-directory: typescript | ||
| run: | | ||
| for pkg in dist/@drumwave/dbmate dist/@drumwave/dbmate-*; do | ||
| echo "Publishing $pkg" | ||
| npm publish "$pkg" | ||
|
jyothsna-m7 marked this conversation as resolved.
|
||
| done | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| package dbmate | ||
|
|
||
| // Version of dbmate | ||
| const Version = "2.35.1" | ||
| const Version = "2.35.1-drumwave.1" | ||
|
jyothsna-m7 marked this conversation as resolved.
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.