From 213885da4bb62ae194263031b48b1044c88664b2 Mon Sep 17 00:00:00 2001
From: iliana etaoin <iliana@oxide.computer>
Date: Tue, 3 Nov 2026 17:16:07 -0800
Subject: [PATCH 1/2] move CI build commands into reusable script

---
 .github/workflows/package.sh         | 16 ++++++++++++++++
 .github/workflows/upload-assets.yaml | 17 +++++------------
 2 files changed, 21 insertions(+), 12 deletions(-)
 create mode 100755 .github/workflows/package.sh

diff --git a/.github/workflows/package.sh b/.github/workflows/package.sh
new file mode 100755
index 000000000..84ca0818a
--- /dev/null
+++ b/.github/workflows/package.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+npm run build
+# Gzip individual files (keep originals)
+ls build/client/assets/*.{js,css,map} | xargs gzip --keep
+# add console_version file
+echo "${SHA}" > build/client/VERSION
+# add API_VERSION file
+cp app/api/__generated__/API_VERSION build/client/API_VERSION
+
+mkdir -p releases/console
+# Make <sha>.tar.gz
+tar czf releases/console/"${SHA}".tar.gz --directory=build/client .
+# Write sha256sum to file
+sha256sum releases/console/"${SHA}".tar.gz | awk '{print $1}' > releases/console/"${SHA}".sha256.txt
diff --git a/.github/workflows/upload-assets.yaml b/.github/workflows/upload-assets.yaml
index 1ed84987c..7c135eac8 100644
--- a/.github/workflows/upload-assets.yaml
+++ b/.github/workflows/upload-assets.yaml
@@ -23,19 +23,12 @@ jobs:
         with:
           project_id: oxide-downloads
       - run: npm install
+
+      # Keep all packaging commands in .github/workflows/package.sh so that
+      # source escrow tooling can re-use the same commands.
       - name: Build for Nexus
-        run: SHA=${{ github.sha }} npm run build
-      - name: Gzip individual files (keep originals)
-        run: ls build/client/assets/*.{js,css,map} | xargs gzip --keep
-      - name: add console_version file
-        run: echo ${{ github.sha }} > build/client/VERSION
-      - name: add API_VERSION file
-        run: cp app/api/__generated__/API_VERSION build/client/API_VERSION
-      - run: mkdir -p releases/console
-      - name: Make <sha>.tar.gz
-        run: tar czf releases/console/${{ github.sha }}.tar.gz --directory=build/client .
-      - name: Write sha256sum to file
-        run: sha256sum releases/console/${{ github.sha }}.tar.gz | awk '{print $1}' > releases/console/${{ github.sha }}.sha256.txt
+        run: SHA=${{ github.sha }} .github/workflows/package.sh
+
       - name: Upload files to GCP bucket
         id: upload-files
         uses: google-github-actions/upload-cloud-storage@v3

From 6172b397fabd6513cf4449a170c4d12787f35cb4 Mon Sep 17 00:00:00 2001
From: David Crespo <david.crespo@oxidecomputer.com>
Date: Tue, 3 Nov 2026 22:40:01 -0600
Subject: [PATCH 2/2] Run package script in PR CI, add license header

---
 .github/workflows/lintBuildTest.yml | 5 +++--
 .github/workflows/package.sh        | 6 ++++++
 .gitignore                          | 3 +++
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lintBuildTest.yml b/.github/workflows/lintBuildTest.yml
index 49bb94589..447ef6f6d 100644
--- a/.github/workflows/lintBuildTest.yml
+++ b/.github/workflows/lintBuildTest.yml
@@ -49,8 +49,9 @@ jobs:
         run: npm run fmt:check
       - name: Test
         run: npm test run -- --project unit
-      - name: Build
-        run: npm run build
+      # Same packaging as upload-assets.yaml, minus the upload
+      - name: Build and package
+        run: SHA=${{ github.sha }} .github/workflows/package.sh
   playwright:
     name: Playwright (${{ matrix.playwright }})
     timeout-minutes: 20
diff --git a/.github/workflows/package.sh b/.github/workflows/package.sh
index 84ca0818a..422565391 100755
--- a/.github/workflows/package.sh
+++ b/.github/workflows/package.sh
@@ -1,4 +1,10 @@
 #!/usr/bin/env bash
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# Copyright Oxide Computer Company
+
 set -euxo pipefail
 
 npm run build
diff --git a/.gitignore b/.gitignore
index 6a5378ae9..d28ce00ca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,3 +40,6 @@ test/visual/**/*.png
 
 # React Router build output. build/client is the deployable static site
 /build/
+
+# package.sh output (.github/workflows/package.sh)
+/releases/