chore: Fix npm ci (#1621)

metal-messiah · web-flow · commit 41d9d3b2b2a5 · 2025-11-04T14:57:14.000-07:00
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
@@ -5,11 +5,7 @@ on:
     # Runs every day at 4AM
     - cron: '0 4 * * *'
   workflow_dispatch:
-
-permissions:
-  id-token: write
-  contents: write
-
+  
 jobs:
   wdio-smoke:
     name: 'WDIO: Smoke Test'
@@ -89,12 +85,7 @@ jobs:
             internal/eu-prod-released.js \
             internal/eu-prod-postamble.js
 
-  deprecate-old-versions:
-    name: Deprecate Unsupported Versions
-    uses: ./.github/workflows/npm-operations.yml
-    with:
-      operation: deprecate-old-versions
-    secrets:
-      NR_API_KEY_PRODUCTION: ${{ secrets.NR_API_KEY_PRODUCTION }}
+  # Note: NPM deprecation of old versions is now handled by npm-operations.yml
+  # on its own schedule (daily at 4AM)
 
   # TODO: Need to add a job for cleaning up experiments to run nightly
diff --git a/.github/workflows/npm-operations.yml b/.github/workflows/npm-operations.yml
@@ -1,50 +1,25 @@
 name: NPM Operations
 
 permissions:
-  # In order to create the git tag, we must have write permissions.
-  contents: write
-  # This is important. Trusted Publishing requires this for the OIDC exchange.
   id-token: write
+  contents: write
 
 on:
-  # Triggered by other workflows for specific NPM operations
-  workflow_call:
-    inputs:
-      operation:
-        description: 'NPM operation to perform'
-        required: true
-        type: string
-        # Valid values: publish-release, publish-prerelease, deprecate-old-versions
-      preid:
-        description: 'Prerelease identifier (e.g., rc, alpha, beta)'
-        required: false
-        type: string
-        default: 'rc'
-      version-override:
-        description: 'Override version for prerelease operations'
-        required: false
-        type: string
-      dry_run:
-        description: 'Dry run mode for testing'
-        required: false
-        type: boolean
-        default: false
-    secrets:
-      GITHUB_LOGIN:
-        required: false
-      GITHUB_EMAIL:
-        required: false
-      NR_API_KEY_PRODUCTION:
-        required: false
-    outputs:
-      operation:
-        description: 'The operation that was performed'
-        value: ${{ jobs.npm-operations.outputs.operation }}
-      success:
-        description: 'Whether the operation was successful'
-        value: ${{ jobs.npm-operations.outputs.success }}
+  # 1. Pull request merge - triggers prerelease operation
+  push:
+    branches:
+      - main
 
-  # Manual trigger for testing/emergency operations
+  # 2. Release - triggers release operations
+  release:
+    types: [published]
+
+  # 3. Scheduled deprecation (keeping existing nightly schedule)
+  schedule:
+    # Runs every day at 4AM
+    - cron: '0 4 * * *'
+
+  # 4. Manual trigger for testing/manual/emergency operations
   workflow_dispatch:
     inputs:
       operation:
@@ -71,7 +46,37 @@ on:
         default: false
 
 jobs:
+  # Determine which operations to run based on trigger
+  determine-operations:
+    runs-on: ubuntu-latest
+    outputs:
+      operations: ${{ steps.determine.outputs.operations }}
+    steps:
+      - name: Determine operations based on trigger
+        id: determine
+        run: |
+          case "${{ github.event_name }}" in
+            "push")
+              echo "operations=[\"publish-prerelease\"]" >> $GITHUB_OUTPUT
+              ;;
+            "release")
+              echo "operations=[\"publish-release\"]" >> $GITHUB_OUTPUT
+              ;;
+            "schedule")
+              echo "operations=[\"deprecate-old-versions\"]" >> $GITHUB_OUTPUT
+              ;;
+            "workflow_dispatch")
+              echo "operations=[\"${{ inputs.operation }}\"]" >> $GITHUB_OUTPUT
+              ;;
+            *)
+              echo "operations=[]" >> $GITHUB_OUTPUT
+              ;;
+          esac
+
+  # Execute NPM operations based on determined operations
   npm-operations:
+    needs: determine-operations
+    if: needs.determine-operations.outputs.operations != '[]'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     defaults:
@@ -80,6 +85,7 @@ jobs:
     env:
       GITHUB_LOGIN: ${{ secrets.GITHUB_LOGIN || secrets.BROWSER_GITHUB_BOT_NAME }}
       GITHUB_EMAIL: ${{ secrets.GITHUB_EMAIL || secrets.BROWSER_GITHUB_BOT_EMAIL }}
+      OPERATION: ${{ fromJson(needs.determine-operations.outputs.operations)[0] }}
     
     steps:
       - uses: actions/checkout@v5
@@ -104,31 +110,34 @@ jobs:
       
       # Install dependencies for publish operations
       - name: Install project dependencies
-        if: inputs.operation == 'publish-release' || inputs.operation == 'publish-prerelease'
+        if: env.OPERATION == 'publish-release' || env.OPERATION == 'publish-prerelease'
         run: npm ci
       
       # Build NPM package for release
       - name: Build npm package
-        if: inputs.operation == 'publish-release'
+        if: env.OPERATION == 'publish-release'
         run: npm run build:npm
       
       # Publish release version
       - name: Publish npm package (release)
-        if: inputs.operation == 'publish-release'
+        if: env.OPERATION == 'publish-release'
         run: npm publish
       
       # Publish prerelease version
       - name: Publish prerelease version
-        if: inputs.operation == 'publish-prerelease'
+        if: env.OPERATION == 'publish-prerelease'
         uses: ./.github/actions/prerelease-npm-version
         with:
           version-override: ${{ inputs.version-override }}
-          preid: ${{ inputs.preid }}
-          dry_run: ${{ inputs.dry_run }}
+          preid: ${{ inputs.preid || 'rc' }}
+          dry_run: ${{ inputs.dry_run || false }}
       
       # Deprecate old versions
       - name: Deprecate old versions
-        if: inputs.operation == 'deprecate-old-versions'
+        if: env.OPERATION == 'deprecate-old-versions'
+        env:
+          # Ensure npm uses the registry URL for authentication
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
           # Get agent EoL table from NRQL
           response=$(curl -X POST https://api.newrelic.com/graphql \
@@ -166,5 +175,5 @@ jobs:
           done
 
     outputs:
-      operation: ${{ inputs.operation }}
+      operation: ${{ env.OPERATION }}
       success: ${{ job.status == 'success' }}
diff --git a/.github/workflows/prerelease-npm-version.yml b/.github/workflows/prerelease-npm-version.yml
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
@@ -1,6 +1,9 @@
 # This workflow is used to build and publish a github release
 # to all platforms. This workflow cannot be manually ran to
 # prevent the same release from being published more than once.
+#
+# Note: NPM publishing and deprecation are now handled automatically by npm-operations.yml
+# when a GitHub release is published
 
 name: Publish Release
 
@@ -225,17 +228,6 @@ jobs:
   #         loader_version: ${{ steps.agent-loader-version.outputs.results }}
   #         environment: stage
 
-  # Publish the agent to npmjs.org
-  call-npm-operations:
-    name: Call NPM Operations
-    uses: ./.github/workflows/npm-operations.yml
-    with:
-      action: publish-release
-    secrets:
-      GITHUB_LOGIN: ${{ secrets.BROWSER_GITHUB_BOT_NAME }}
-      GITHUB_EMAIL: ${{ secrets.BROWSER_GITHUB_BOT_EMAIL }}
-      NR_API_KEY_PRODUCTION: ${{ secrets.NR_API_KEY_PRODUCTION }}
-
   # Raise the release notes pr on the docs website repo
   raise-release-notes-pr:
     needs: [publish-prod-to-s3]
@@ -262,7 +254,7 @@ jobs:
 
   # Notify the release repo of the new release
   notify-release-repo:
-    needs: [publish-to-nr-prod, call-npm-operations]
+    needs: [publish-to-nr-prod]
     runs-on: ubuntu-latest
     timeout-minutes: 30
     defaults:
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
@@ -3,6 +3,9 @@
 # When the release PR is merged, this action will create a Github release. Our docs-site PR workflow will use the
 # contents of the changelog.json file and PR headers to generate release notes for the public docs website.
 # See https://github.com/google-github-actions/release-please-action
+#
+# Note: NPM prerelease publishing is now handled automatically by npm-operations.yml when this workflow
+# pushes to the main branch (triggering automatic RC version publishing)
 
 on:
   push:
@@ -32,13 +35,3 @@ jobs:
               {"type":"fix","section":"Bug Fixes"},
               {"type":"security","section":"Security Fixes"}
             ]
-    # Bump a new prerelease version and publish to NPM.
-  prerelease-npm-version:
-    needs: release-please
-    uses: ./.github/workflows/npm-operations.yml
-    with:
-      operation: publish-prerelease
-      preid: rc
-    secrets:
-      GITHUB_LOGIN: ${{ secrets.BROWSER_GITHUB_BOT_NAME }}
-      GITHUB_EMAIL: ${{ secrets.BROWSER_GITHUB_BOT_EMAIL }}
