From d51e3b6ae8f633873f75285b034b523f08ee2049 Mon Sep 17 00:00:00 2001 From: Fernando Alonso Date: Wed, 28 Oct 2026 21:02:17 +0000 Subject: [PATCH 1/4] ci(release): migrate npm publishing to OSS Exit Gate --- .github/scripts/publish_package.sh | 36 +++++++++++++++++++++++++++--- .github/workflows/release.yml | 12 ++++++++-- 2 files changed, 43 insertions(+), 5 deletions(-) diff --git a/.github/scripts/publish_package.sh b/.github/scripts/publish_package.sh index d4a7bb4e0b..fc23459ffb 100755 --- a/.github/scripts/publish_package.sh +++ b/.github/scripts/publish_package.sh @@ -17,7 +17,37 @@ set -e set -u -echo "//wombat-dressing-room.appspot.com/:_authToken=${NPM_AUTH_TOKEN}" >> .npmrc +touch "$HOME/.npmrc" +cat << 'NPMRC_EOF' > .npmrc +registry=https://us-npm.pkg.dev/oss-exit-gate-prod/firebase-admin-node--npm/ +//us-npm.pkg.dev/oss-exit-gate-prod/firebase-admin-node--npm/:always-auth=true +NPMRC_EOF +npx --yes --registry=https://registry.npmjs.org/ google-artifactregistry-auth --repo-config=.npmrc --credential-config="$HOME/.npmrc" -readonly UNPREFIXED_VERSION=`echo ${VERSION} | cut -c 2-` -npm publish ./dist/firebase-admin-${UNPREFIXED_VERSION}.tgz --registry https://wombat-dressing-room.appspot.com +if [ -z "${VERSION:-}" ]; then + echo "Error: VERSION environment variable is not set." >&2 + exit 1 +fi +readonly UNPREFIXED_VERSION=$(echo "${VERSION}" | cut -c 2-) +npm publish "./dist/firebase-admin-${UNPREFIXED_VERSION}.tgz" \ + --registry="https://us-npm.pkg.dev/oss-exit-gate-prod/firebase-admin-node--npm/" \ + --provenance=false + +cat << MANIFEST_EOF > manifest.json +{ + "publish_all": false, + "publishing_groups": [ + { + "packages": [ + { + "name": "firebase-admin", + "version": "${UNPREFIXED_VERSION}" + } + ] + } + ] +} +MANIFEST_EOF + +gcloud storage cp manifest.json \ + "gs://oss-exit-gate-prod-projects-bucket/firebase-admin-node/npm/manifests/manifest-${GITHUB_RUN_ID:-manual}-${GITHUB_RUN_ATTEMPT:-1}.json" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b4ef8c68bb..0c87808e18 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -111,6 +111,7 @@ jobs: environment: Release permissions: contents: write + id-token: write steps: - name: Checkout source for publish @@ -147,8 +148,15 @@ jobs: --title "Firebase Admin Node.js SDK $RELEASE_VER" \ --notes "$RELEASE_BODY" - - name: Publish to NPM + - name: Authenticate to Google Cloud (OSS Exit Gate) + uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed + with: + workload_identity_provider: 'projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github' + + - name: Set up Cloud SDK + uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f + + - name: Publish to NPM via OSS Exit Gate run: ./.github/scripts/publish_package.sh env: - NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }} VERSION: ${{ steps.preflight.outputs.version }} From a14626b14722ef11b9d207483364a70d312b4e37 Mon Sep 17 00:00:00 2001 From: alonsopf89 Date: Wed, 4 Nov 2026 11:34:31 -0800 Subject: [PATCH 2/4] ci: clean up stale releases from staging repo before publishing --- .github/workflows/release.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0c87808e18..3f2e4b8ab7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -156,6 +156,25 @@ jobs: - name: Set up Cloud SDK uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f + - name: Clean up stale releases from staging repo + run: | + # clean up stale releases from staging repo + packages=$(gcloud artifacts packages list \ + --project="oss-exit-gate-prod" \ + --location="us" \ + --repository="firebase-admin-node--npm" \ + --format="value(name)" 2>/dev/null) + + echo "${packages}" | xargs -r -I {} sh -c ' + package_name=$(basename "{}") + echo "Deleting package: $package_name..." + gcloud artifacts packages delete "{}" \ + --project="\'"oss-exit-gate-prod"\'" \ + --location="\'"us"\'" \ + --repository="\'firebase-admin-node--npm\'" \ + --quiet + ' + - name: Publish to NPM via OSS Exit Gate run: ./.github/scripts/publish_package.sh env: From c5a514df3876caac236e94be47d2bab1d7c24510 Mon Sep 17 00:00:00 2001 From: alonsopf89 Date: Wed, 4 Nov 2026 21:40:05 +0000 Subject: [PATCH 3/4] ci(release): fix quote syntax in stale release cleanup step --- .github/workflows/release.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3f2e4b8ab7..bd931c4dc1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -169,9 +169,9 @@ jobs: package_name=$(basename "{}") echo "Deleting package: $package_name..." gcloud artifacts packages delete "{}" \ - --project="\'"oss-exit-gate-prod"\'" \ - --location="\'"us"\'" \ - --repository="\'firebase-admin-node--npm\'" \ + --project=""oss-exit-gate-prod"" \ + --location=""us"" \ + --repository="firebase-admin-node--npm" \ --quiet ' From 5185e89d145e018f89a5e00a9197883faa03586e Mon Sep 17 00:00:00 2001 From: alonsopf89 Date: Wed, 4 Nov 2026 19:57:29 -0800 Subject: [PATCH 4/4] ci: fix quote syntax in staging repo cleanup step --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bd931c4dc1..5df7e46c5c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -169,8 +169,8 @@ jobs: package_name=$(basename "{}") echo "Deleting package: $package_name..." gcloud artifacts packages delete "{}" \ - --project=""oss-exit-gate-prod"" \ - --location=""us"" \ + --project="oss-exit-gate-prod" \ + --location="us" \ --repository="firebase-admin-node--npm" \ --quiet '