Skip to content

ci(release): migrate npm publishing to OSS Exit Gate #3294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alonsopf89 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci(release): migrate npm publishing to OSS Exit Gate #3294

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 33 additions & 3 deletions .github/scripts/publish_package.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,37 @@
set -e
set -u

echo "//wombat-dressing-room.appspot.com/:_authToken=${NPM_AUTH_TOKEN}" >> .npmrc
touch "$HOME/.npmrc"
cat << 'NPMRC_EOF' > .npmrc
registry=https://us-npm.pkg.dev/oss-exit-gate-prod/firebase-admin-node--npm/
//us-npm.pkg.dev/oss-exit-gate-prod/firebase-admin-node--npm/:always-auth=true
NPMRC_EOF
npx --yes --registry=https://registry.npmjs.org/ google-artifactregistry-auth --repo-config=.npmrc --credential-config="$HOME/.npmrc"

readonly UNPREFIXED_VERSION=`echo ${VERSION} | cut -c 2-`
npm publish ./dist/firebase-admin-${UNPREFIXED_VERSION}.tgz --registry https://wombat-dressing-room.appspot.com
if [ -z "${VERSION:-}" ]; then
echo "Error: VERSION environment variable is not set." >&2
exit 1
fi
readonly UNPREFIXED_VERSION=$(echo "${VERSION}" | cut -c 2-)

@gemini-code-assist gemini-code-assist Bot Oct 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Since set -u is enabled, referencing the VERSION environment variable when it is not set will cause the script to crash immediately with an unbound variable error. Adding a defensive check ensures a clear, actionable error message is printed if the variable is missing.

Suggested change
readonly UNPREFIXED_VERSION=$(echo "${VERSION}" | cut -c 2-)
if [ -z "${VERSION:-}" ]; then\n echo "Error: VERSION environment variable is not set." >&2\n exit 1\nfi\nreadonly UNPREFIXED_VERSION=$(echo "${VERSION}" | cut -c 2-)

@alonsopf89 alonsopf89 Oct 28, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed! Added the defensive check for ${VERSION:-} before computing UNPREFIXED_VERSION.

npm publish "./dist/firebase-admin-${UNPREFIXED_VERSION}.tgz" \
--registry="https://us-npm.pkg.dev/oss-exit-gate-prod/firebase-admin-node--npm/" \
--provenance=false

cat << MANIFEST_EOF > manifest.json
{
"publish_all": false,
"publishing_groups": [
{
"packages": [
{
"name": "firebase-admin",
"version": "${UNPREFIXED_VERSION}"
}
]
}
]
}
MANIFEST_EOF

gcloud storage cp manifest.json \
"gs://oss-exit-gate-prod-projects-bucket/firebase-admin-node/npm/manifests/manifest-${GITHUB_RUN_ID:-manual}-${GITHUB_RUN_ATTEMPT:-1}.json"
12 changes: 10 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,7 @@ jobs:
environment: Release
permissions:
contents: write
id-token: write

steps:
- name: Checkout source for publish
Expand Down Expand Up @@ -147,8 +148,15 @@ jobs:
--title "Firebase Admin Node.js SDK $RELEASE_VER" \
--notes "$RELEASE_BODY"

- name: Publish to NPM
- name: Authenticate to Google Cloud (OSS Exit Gate)
uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed
with:
workload_identity_provider: 'projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github'

- name: Set up Cloud SDK
uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f

- name: Publish to NPM via OSS Exit Gate
run: ./.github/scripts/publish_package.sh
env:
NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
VERSION: ${{ steps.preflight.outputs.version }}
Loading