release.yml

name: Release npm package

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 35
    environment: npm-production
    steps:
      - uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          cache: npm
      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: "21"
      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: "8.0.x"
      - uses: actions/setup-go@v6
        with:
          go-version: "1.24.x"
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: "3.4"
      - name: Verify immutable release identity
        run: |
          node -e "const p=require('./package.json'); const tag=process.env.GITHUB_REF_NAME; if(tag !== 'v'+p.version) throw new Error('tag '+tag+' does not match package '+p.version)"
          git tag --points-at HEAD | grep -Fx "${GITHUB_REF_NAME}"
          if [ "$(git cat-file -t "refs/tags/${GITHUB_REF_NAME}")" != "tag" ]; then
            echo "::error::Release tags must be annotated tags"
            exit 1
          fi
          default_branch="${{ github.event.repository.default_branch }}"
          if ! git merge-base --is-ancestor "$GITHUB_SHA" "origin/$default_branch"; then
            echo "::error::Release commit $GITHUB_SHA is not reachable from protected $default_branch"
            exit 1
          fi
      - run: npm ci --ignore-scripts
      - run: npx playwright install --with-deps chromium firefox webkit
      - run: xvfb-run -a npm run check
        env:
          COCKROACH_BROWSER_E2E: "1"
          COCKROACH_BROWSER_MULTI_ENGINE_E2E: "1"
          COCKROACH_BROWSER_FULL_PLATFORM_E2E: "1"
          COCKROACH_BROWSER_HEADED_E2E: "1"
          COCKROACH_BROWSER_PUPPETEER_NO_SANDBOX: "1"
      - name: Verify all language SDKs
        run: |
          python -m compileall -q sdks/python/cockroach_browser
          mvn --batch-mode --file sdks/java/pom.xml package
          dotnet build sdks/dotnet/CockroachBrowser/CockroachBrowser.csproj --configuration Release --nologo
          ruby -c sdks/ruby/lib/cockroach_browser.rb
          (cd sdks/go && go test ./...)
      - name: Remove generated SDK outputs before packaging
        run: npm run clean && npm run build && npm run check:package
      - name: Stage deterministic release assets
        shell: bash
        run: |
          release_asset_dir="$RUNNER_TEMP/cockroach-browser-release-assets"
          node scripts/stage-release-assets.mjs --out "$release_asset_dir"
          echo "RELEASE_ASSET_DIR=$release_asset_dir" >> "$GITHUB_ENV"
      - name: Select the immutable npm release channel
        id: channel
        shell: bash
        run: |
          package_name="$(node -p "require('./package.json').name")"
          package_version="$(node -p "require('./package.json').version")"
          stable_latest="$(npm view "$package_name" dist-tags.latest 2>/dev/null || true)"
          if [[ "$package_version" == *-* ]]; then
            if [ -z "$stable_latest" ] || [ "$stable_latest" = "$package_version" ]; then
              echo "::error::A prerelease requires an existing, different stable latest version"
              exit 1
            fi
            echo "npm_tag=next" >> "$GITHUB_OUTPUT"
            echo "prerelease=true" >> "$GITHUB_OUTPUT"
            echo "stable_latest=$stable_latest" >> "$GITHUB_OUTPUT"
          else
            echo "npm_tag=latest" >> "$GITHUB_OUTPUT"
            echo "prerelease=false" >> "$GITHUB_OUTPUT"
            echo "stable_latest=$package_version" >> "$GITHUB_OUTPUT"
          fi
      - name: Check for an existing immutable npm artifact
        id: registry
        shell: bash
        run: |
          package_name="$(node -p "require('./package.json').name")"
          package_version="$(node -p "require('./package.json').version")"
          package_spec="${package_name}@${package_version}"
          current_head="$(git rev-parse HEAD)"
          pack_json="$(npm pack --dry-run --ignore-scripts --json)"
          local_shasum="$(node -e "const fs=require('fs'); console.log(JSON.parse(fs.readFileSync(0, 'utf8'))[0].shasum)" <<<"$pack_json")"
          local_integrity="$(node -e "const fs=require('fs'); console.log(JSON.parse(fs.readFileSync(0, 'utf8'))[0].integrity)" <<<"$pack_json")"

          echo "shasum=${local_shasum}" >> "$GITHUB_OUTPUT"
          echo "integrity=${local_integrity}" >> "$GITHUB_OUTPUT"

          if npm view "$package_spec" version >/dev/null 2>&1; then
            published_head="$(npm view "$package_spec" gitHead 2>/dev/null || true)"
            published_shasum="$(npm view "$package_spec" dist.shasum)"
            published_integrity="$(npm view "$package_spec" dist.integrity)"

            if [ -n "$published_head" ] && [ "$published_head" != "$current_head" ]; then
              echo "::error::${package_spec} already exists from gitHead ${published_head}, not ${current_head}"
              exit 1
            fi
            if [ "$published_shasum" != "$local_shasum" ] || [ "$published_integrity" != "$local_integrity" ]; then
              echo "::error::${package_spec} exists, but its immutable tarball identity does not match this tag"
              exit 1
            fi

            echo "The exact npm artifact already exists with matching SHA-1 and SHA-512 identities; publication is idempotent."
            echo "publish=false" >> "$GITHUB_OUTPUT"
          else
            echo "No existing npm artifact was found for ${package_spec}."
            echo "publish=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Publish to npm with provenance
        if: steps.registry.outputs.publish == 'true'
        run: npm publish --access public --provenance --tag "${{ steps.channel.outputs.npm_tag }}"
      - name: Verify npm release identity
        shell: bash
        run: |
          package_name="$(node -p "require('./package.json').name")"
          package_version="$(node -p "require('./package.json').version")"
          package_spec="${package_name}@${package_version}"
          current_head="$(git rev-parse HEAD)"
          expected_shasum="${{ steps.registry.outputs.shasum }}"
          expected_integrity="${{ steps.registry.outputs.integrity }}"

          for attempt in 1 2 3 4 5 6; do
            published_head="$(npm view "$package_spec" gitHead 2>/dev/null || true)"
            published_shasum="$(npm view "$package_spec" dist.shasum 2>/dev/null || true)"
            published_integrity="$(npm view "$package_spec" dist.integrity 2>/dev/null || true)"

            if [ "$published_shasum" = "$expected_shasum" ] && [ "$published_integrity" = "$expected_integrity" ]; then
              if [ -n "$published_head" ] && [ "$published_head" != "$current_head" ]; then
                echo "::error::npm exposes ${package_spec} from gitHead ${published_head}, not ${current_head}"
                exit 1
              fi
              selected_tag="$(npm view "$package_name" "dist-tags.${{ steps.channel.outputs.npm_tag }}")"
              latest_tag="$(npm view "$package_name" dist-tags.latest)"
              if [ "$selected_tag" != "$package_version" ]; then
                echo "::error::npm ${{ steps.channel.outputs.npm_tag }} points to ${selected_tag}, not ${package_version}"
                exit 1
              fi
              if [ "${{ steps.channel.outputs.prerelease }}" = "true" ] && [ "$latest_tag" != "${{ steps.channel.outputs.stable_latest }}" ]; then
                echo "::error::npm latest moved from ${{ steps.channel.outputs.stable_latest }} to ${latest_tag} during prerelease publication"
                exit 1
              fi
              npm view "$package_spec" version dist.shasum dist.integrity dist.tarball gitHead
              npm view "$package_name" dist-tags --json
              exit 0
            fi
            echo "Waiting for npm registry propagation (${attempt}/6)..."
            sleep 10
          done

          echo "::error::npm did not expose ${package_spec} with the expected immutable tarball identity"
          exit 1
      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
            echo "GitHub release ${GITHUB_REF_NAME} already exists."
          else
            prerelease_flag=()
            if [ "${{ steps.channel.outputs.prerelease }}" = "true" ]; then
              prerelease_flag+=(--prerelease)
            fi
            gh release create "$GITHUB_REF_NAME" \
              --verify-tag \
              --title "Cockroach Browser $GITHUB_REF_NAME" \
              --notes-file "$RELEASE_ASSET_DIR/cockroach-browser-$(node -p "require('./package.json').version")-release-notes.md" \
              "${prerelease_flag[@]}"
          fi
          release_json="$(gh release view "$GITHUB_REF_NAME" --json isDraft,isPrerelease)"
          node -e '
            const release = JSON.parse(process.argv[1]);
            const expected = process.argv[2] === "true";
            if (release.isDraft || release.isPrerelease !== expected) {
              throw new Error(`GitHub release state mismatch: ${JSON.stringify(release)}`);
            }
          ' "$release_json" "${{ steps.channel.outputs.prerelease }}"
          existing_assets="$(gh release view "$GITHUB_REF_NAME" --json assets --jq '.assets[].name')"
          for asset in "$RELEASE_ASSET_DIR"/*; do
            asset_name="$(basename "$asset")"
            if grep -Fxq "$asset_name" <<<"$existing_assets"; then
              download_dir="$(mktemp -d)"
              gh release download "$GITHUB_REF_NAME" --pattern "$asset_name" --dir "$download_dir"
              if ! cmp --silent "$asset" "$download_dir/$asset_name"; then
                echo "::error::Existing release asset $asset_name has a different immutable identity"
                exit 1
              fi
              echo "Verified existing immutable release asset $asset_name."
            else
              gh release upload "$GITHUB_REF_NAME" "$asset"
            fi
          done