npmPublish.yml

on:
  workflow_call:
    secrets:
      NPM_TOKEN:
        description: npm token
      AWS_ACCESS_KEY_ID:
        description: AWS access key id. Only required if sign = true
      AWS_SECRET_ACCESS_KEY:
        description: AWS secret access key. Only required if sign = true

    inputs:
      tag:
        required: false
        description: tag used to publish to npm
        default: latest
        type: string
      sign:
        required: false
        description: signs the package using sf-release if set to true
        default: false
        type: boolean
      dryrun:
        required: false
        description: if true, the job will run but will not publish to npm or push to git
        default: false
        type: boolean
      prerelease:
        required: false
        description: if true, it will use the version <version>-<branch>.0
        type: boolean
        default: false
      nodeVersion:
        description: version of node to use.  It's better to specify latest, lts/* or lts/-1 than to hardode numbers
        type: string
        default: lts/*
        required: false
      ctc:
        description: |
          Use CTC.
          - Only opens when publishing to 'latest'. Will NOT open for prerelease tags (e.g. dev, beta, qa)
          - Requires env vars: SF_CHANGE_CASE_SFDX_AUTH_URL, SF_CHANGE_CASE_TEMPLATE_ID, SF_CHANGE_CASE_CONFIGURATION_ITEM.
          - Requires a static IP runner (you cannot use ubuntu-latest)
        type: boolean
        required: false
      runsOn:
        description: the runner.  Only needed if you need a non-public runner (ex, for git checkout from IP restricted private repo)
        default: ubuntu-latest
        required: false
        type: string
      githubTag:
        description: the github release tag that you want to publish as an npm package
        required: true
        type: string
      packageManager:
        description: the package manager to use. Defaults to yarn; supports npm, pnpm, or yarn
        required: false
        default: yarn
        type: string
      packageManagerVersion:
        description: pnpm version to use when packageManager is pnpm
        required: false
        default: '10'
        type: string
      cacheDependencyPath:
        description: path to the package manager lockfile; auto-derived from packageManager if not set
        required: false
        default: ''
        type: string
      vulnerabilityCheck:
        description: if true, checks for known vulnerable package versions
        required: false
        default: true
        type: boolean
      packagePath:
        description: relative path to the package to publish, should start with a ".".  Defaults to the root of the repository.  Useful for monorepos.
        required: false
        type: string
        default: .
      trustedPublishing:
        description: |
          Publish to npm using trusted publishing (OIDC) instead of an NPM_TOKEN.
          - The calling workflow must also grant `id-token: write` permission.
          - Configure the trusted publisher on npmjs.com against your CALLING workflow's filename (not npmPublish.yml), since npm validates the top-level workflow.
          - Requires npm >= 11.5.1 and Node >= 22.14.0 (this workflow installs npm@latest when enabled).
        required: false
        type: boolean
        default: false

jobs:
  check-publish:
    outputs:
      published: ${{ steps.is-published.outputs.published }}
    runs-on: ubuntu-latest
    env:
      INPUTS_GITHUB_TAG: ${{ inputs.githubTag }}
      INPUTS_PACKAGE_MANAGER: ${{ inputs.packageManager }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.githubTag }}
      - name: Validate package manager
        run: |
          if [[ "$INPUTS_PACKAGE_MANAGER" != "yarn" && "$INPUTS_PACKAGE_MANAGER" != "npm" && "$INPUTS_PACKAGE_MANAGER" != "pnpm" ]]; then
            echo "Error: packageManager must be 'npm', 'pnpm', or 'yarn', got '$INPUTS_PACKAGE_MANAGER'"
            exit 1
          fi
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.nodeVersion }}

      - name: Is published
        id: is-published
        run: |
          RESPONSE=$(npm view .@$INPUTS_GITHUB_TAG version --json --silent || echo "Not published")

          # The response is wrapped in double quotes, so we need to compare it with (escaped) quotes
          if [ "$RESPONSE" = "\"$INPUTS_GITHUB_TAG\"" ]; then
            echo "published=true" >> "$GITHUB_OUTPUT"
          else
            echo "published=false" >> "$GITHUB_OUTPUT"
          fi
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        working-directory: ${{ inputs.packagePath }}

      - run: echo "[INFO] Is package published:\ $STEPS_IS_PUBLISHED_PUBLISHED"
        env:
          STEPS_IS_PUBLISHED_PUBLISHED: ${{ steps.is-published.outputs.published }}

      - name: Fail if published
        if: steps.is-published.outputs.published == 'true'
        uses: actions/github-script@v7
        with:
          script: core.setFailed(`The version '${process.env.INPUTS_GITHUB_TAG}' has already been published to npm`)

  ctc-open:
    needs: [check-publish]
    # CTC will only open when publishing to 'latest'
    if: inputs.ctc && needs.check-publish.outputs.published == 'false' && inputs.tag == 'latest'
    uses: salesforcecli/github-workflows/.github/workflows/ctcOpen.yml@main
    with:
      githubTag: ${{ inputs.githubTag }}
      nodeVersion: ${{ inputs.nodeVersion }}
      package-manager: ${{ inputs.packageManager }}
      package-manager-version: ${{ inputs.packageManagerVersion }}
      cache-dependency-path: ${{ inputs.cacheDependencyPath || (inputs.packageManager == 'yarn' && 'yarn.lock' || (inputs.packageManager == 'pnpm' && 'pnpm-lock.yaml' || 'package-lock.json')) }}
    secrets: inherit

  npm-publish:
    needs: [check-publish, ctc-open]
    if: ${{ always() && needs.check-publish.outputs.published == 'false' && (!inputs.ctc || (inputs.ctc && inputs.tag != 'latest') || (inputs.ctc && needs.ctc-open.outputs.changeCaseId)) }}
    runs-on: ${{ inputs.runsOn }}
    permissions:
      # Required for npm trusted publishing (OIDC). Only used when inputs.trustedPublishing is true.
      id-token: write
      contents: read
    env:
      INPUTS_PACKAGE_MANAGER: ${{ inputs.packageManager }}
      INPUTS_GITHUB_TAG: ${{ inputs.githubTag }}
      INPUTS_TAG: ${{ inputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.githubTag }}
      - name: Setup pnpm
        if: inputs.packageManager == 'pnpm'
        uses: pnpm/action-setup@v4
        with:
          version: ${{ inputs.packageManagerVersion }}
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.nodeVersion }}
          cache: ${{ inputs.packageManager }}
          cache-dependency-path: ${{ inputs.cacheDependencyPath || (inputs.packageManager == 'yarn' && 'yarn.lock' || (inputs.packageManager == 'pnpm' && 'pnpm-lock.yaml' || 'package-lock.json')) }}
      - name: Install dependencies with yarn
        if: inputs.packageManager == 'yarn'
        uses: salesforcecli/github-workflows/.github/actions/yarnInstallWithRetries@main
      - name: Install dependencies with npm
        if: inputs.packageManager == 'npm'
        uses: salesforcecli/github-workflows/.github/actions/npmInstallWithRetries@main
      - name: Install dependencies with pnpm
        if: inputs.packageManager == 'pnpm'
        uses: salesforcecli/github-workflows/.github/actions/pnpmInstallWithRetries@main
      - name: Vulnerability check
        if: inputs.vulnerabilityCheck
        # Check for known vulnerable packages from the following supply chain attacks:
        run: |
          vulns=(
            # keeping one past (unpublished) check as an example
            # Add new vulns here as a quick deny-list
            "chalk@5.6.1"
          )

          for vuln in "${vulns[@]}"; do
            if [[ -n $(npm ls --depth=99 --parseable "$vuln") ]]; then
              echo "VULNERABILITY FOUND: $vuln"
              exit 1
            else
              echo "Known vulnerability not found: $vuln"
            fi
          done

          # Known string from exploits
          # This is a past known example, leaving it hear as an example
          # https://github.com/chalk/chalk/issues/656#issuecomment-3266880534
          strings=(
            "_0x112fa8"
          )

          for str in "${strings[@]}"; do
            if grep -r "$str" --include='*.js' .; then
              echo "VULNERABILITY FOUND: string '$str' found in js files"
              exit 1
            else
              echo "String '$str' not found in js files"
            fi
          done
      - run: $INPUTS_PACKAGE_MANAGER run build
      - name: Upgrade npm for trusted publishing
        # Trusted publishing (OIDC) requires npm >= 11.5.1, newer than the npm bundled with Node LTS.
        if: inputs.trustedPublishing
        run: npm install -g npm@latest
      - run: npm install -g @salesforce/plugin-release-management
      - name: NPM Release
        run: |
          sf-release npm:package:release \
            --githubtag "$INPUTS_GITHUB_TAG" \
            --npmtag "$INPUTS_TAG" \
            --no-install \
            ${{ inputs.dryrun && '--dryrun' || '' }} \
            ${{ inputs.prerelease && format('--prerelease {0}', github.ref_name) || '' }} \
            ${{ inputs.sign && '--sign' || '' }} \
            ${{ inputs.trustedPublishing && '--trusted-publishing' || '' }}
        working-directory: ${{ inputs.packagePath }}
        env:
          # Omit the token in trusted-publishing mode so npm uses the OIDC flow.
          NPM_TOKEN: ${{ inputs.trustedPublishing && '' || secrets.NPM_TOKEN }}
          AWS_ACCESS_KEY_ID: ${{secrets.AWS_ACCESS_KEY_ID}}
          AWS_SECRET_ACCESS_KEY: ${{secrets.AWS_SECRET_ACCESS_KEY}}

  ctcCloseSuccess:
    needs: [ctc-open, npm-publish]
    if: needs.ctc-open.result == 'success' && needs.npm-publish.result == 'success' && needs.ctc-open.outputs.changeCaseId
    uses: salesforcecli/github-workflows/.github/workflows/ctcClose.yml@main
    secrets: inherit
    with:
      changeCaseId: ${{needs.ctc-open.outputs.changeCaseId}}
      nodeVersion: ${{ inputs.nodeVersion }}
      package-manager: ${{ inputs.packageManager }}
      package-manager-version: ${{ inputs.packageManagerVersion }}
      cache-dependency-path: ${{ inputs.cacheDependencyPath || (inputs.packageManager == 'yarn' && 'yarn.lock' || (inputs.packageManager == 'pnpm' && 'pnpm-lock.yaml' || 'package-lock.json')) }}

  ctcCloseFail:
    needs: [ctc-open, npm-publish]
    if: always() && inputs.ctc && needs.ctc-open.outputs.changeCaseId && (needs.ctc-open.result != 'success' || needs.npm-publish.result != 'success')
    uses: salesforcecli/github-workflows/.github/workflows/ctcClose.yml@main
    secrets: inherit
    with:
      changeCaseId: ${{ needs.ctc-open.outputs.changeCaseId }}
      nodeVersion: ${{ inputs.nodeVersion }}
      status: Not Implemented
      package-manager: ${{ inputs.packageManager }}
      package-manager-version: ${{ inputs.packageManagerVersion }}
      cache-dependency-path: ${{ inputs.cacheDependencyPath || (inputs.packageManager == 'yarn' && 'yarn.lock' || (inputs.packageManager == 'pnpm' && 'pnpm-lock.yaml' || 'package-lock.json')) }}