Skip to content

ci: migrate npm release workflows from Wombat to OSS Exit Gate - #6092

Open
alonsopf89 wants to merge 2 commits into
material-components:mainfrom
alonsopf89:oss-exit-gate-migration
Open

alonsopf89 wants to merge 2 commits into
material-components:mainfrom
alonsopf89:oss-exit-gate-migration

Conversation

@alonsopf89

Copy link
Copy Markdown

Summary

Migrates the @material/web npm publishing workflows (.github/workflows/publish.yml and .github/workflows/nightly.yml) from the legacy Wombat Dressing Room proxy (https://wombat-dressing-room.appspot.com/ / NODE_AUTH_TOKEN) to OSS Exit Gate (b/496177586, b/576671324).

Key Changes

  • Workload Identity Federation (WIF): Authenticates keyless via google-github-actions/auth against the OSS Exit Gate WIF provider (projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github), eliminating static NODE_AUTH_TOKEN secrets.
  • Artifact Registry Staging: Stages @material/web tarballs to https://us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/.
  • Release Manifest Trigger: Uploads the release manifest to gs://oss-exit-gate-prod-projects-bucket/material-web/npm/manifests/ (including registry_config.npm.tags: ["nightly"] for nightly builds).
  • End-to-End Verification: Provisioned in Piper (cl/1003882089, cl/1004023214, cl/1004034531) and verified via Step 8 smoke test.

@asyncliz

Copy link
Copy Markdown
Collaborator

Hey @alonsopf89! Thanks for helping out with this migration. Feel free to request my review on this PR when you're ready for it, and I can help with the import and Copybara process :)

@alonsopf89

Copy link
Copy Markdown
Author

Hi @asyncliz — the OSS Exit Gate production configuration (material-web/npm) and end-to-end Artifact Registry + GCS manifest smoke test are complete, and this PR is Ready for Review with all CI, CLA, and zizmor checks passing. Please let us know if this looks good to merge (or if you prefer to mirror it from internal Piper), after which we will submit the final ownership handoff CL. Thanks!

@asyncliz

Copy link
Copy Markdown
Collaborator

I added the "Ready for Google" label to kick off the Copybara import process. That will generate an internal CL that (once submitted) will merge this PR

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants