npmPublish.yml

on:
  workflow_call:
    secrets:
      NPM_TOKEN:
        description: npm token
      AWS_ACCESS_KEY_ID:
        description: AWS access key id. Only required if sign = true
      AWS_SECRET_ACCESS_KEY:
        description: AWS secret access key. Only required if sign = true

    inputs:
      tag:
        required: false
        description: tag used to publish to npm
        default: latest
        type: string
      sign:
        required: false
        description: signs the package using sf-release if set to true
        default: false
        type: boolean
      dryrun:
        required: false
        description: if true, the job will run but will not publish to npm or push to git
        default: false
        type: boolean
      prerelease:
        required: false
        description: if true, it will use the version <version>-<branch>.0
        type: boolean
        default: false
      nodeVersion:
        description: version of node to use.  It's better to specify latest, lts/* or lts/-1 than to hardode numbers
        type: string
        default: lts/*
        required: false
      ctc:
        description: |
          Use CTC.
          - Only opens when publishing to 'latest'. Will NOT open for prerelease tags (e.g. dev, beta, qa)
          - Requires env vars: SF_CHANGE_CASE_SFDX_AUTH_URL, SF_CHANGE_CASE_TEMPLATE_ID, SF_CHANGE_CASE_CONFIGURATION_ITEM.
          - Requires a static IP runner (you cannot use ubuntu-latest)
        type: boolean
        required: false
      runsOn:
        description: the runner.  Only needed if you need a non-public runner (ex, for git checkout from IP restricted private repo)
        default: ubuntu-latest
        required: false
        type: string
      githubTag:
        description: the github release tag that you want to publish as an npm package
        required: true
        type: string
      packageManager:
        description: the package manager to use.  Defaults to yarn, but can be set to npm
        required: false
        default: yarn
        type: string
      vulnerabilityCheck:
        description: if true, checks for known vulnerable package versions
        required: false
        default: true
        type: boolean
      packagePath:
        description: relative path to the package to publish, should start with a ".".  Defaults to the root of the repository.  Useful for monorepos.
        required: false
        type: string
        default: .

jobs:
  check-publish:
    outputs:
      published: ${{ steps.is-published.outputs.published }}
    runs-on: ubuntu-latest
    env:
      INPUTS_GITHUB_TAG: ${{ inputs.githubTag }}
      INPUTS_PACKAGE_MANAGER: ${{ inputs.packageManager }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.githubTag }}
      - name: Validate package manager
        run: |
          if [[ "$INPUTS_PACKAGE_MANAGER" != "yarn" && "$INPUTS_PACKAGE_MANAGER" != "npm" ]]; then
            echo "Error: packageManager must be 'yarn' or 'npm', got '$INPUTS_PACKAGE_MANAGER'"
            exit 1
          fi
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.nodeVersion }}

      - name: Is published
        id: is-published
        run: |
          RESPONSE=$(npm view .@$INPUTS_GITHUB_TAG version --json --silent || echo "Not published")

          # The response is wrapped in double quotes, so we need to compare it with (escaped) quotes
          if [ "$RESPONSE" = "\"$INPUTS_GITHUB_TAG\"" ]; then
            echo "published=true" >> "$GITHUB_OUTPUT"
          else
            echo "published=false" >> "$GITHUB_OUTPUT"
          fi
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        working-directory: ${{ inputs.packagePath }}

      - run: echo "[INFO] Is package published:\ $STEPS_IS_PUBLISHED_PUBLISHED"
        env:
          STEPS_IS_PUBLISHED_PUBLISHED: ${{ steps.is-published.outputs.published }}

      - name: Fail if published
        if: steps.is-published.outputs.published == 'true'
        uses: actions/github-script@v7
        with:
          script: core.setFailed(`The version '${process.env.INPUTS_GITHUB_TAG}' has already been published to npm`)

  ctc-open:
    needs: [check-publish]
    # CTC will only open when publishing to 'latest'
    if: inputs.ctc && needs.check-publish.outputs.published == 'false' && inputs.tag == 'latest'
    uses: salesforcecli/github-workflows/.github/workflows/ctcOpen.yml@main
    with:
      githubTag: ${{ inputs.githubTag }}
    secrets: inherit

  npm-publish:
    needs: [check-publish, ctc-open]
    if: ${{ always() && needs.check-publish.outputs.published == 'false' && (!inputs.ctc || (inputs.ctc && inputs.tag != 'latest') || (inputs.ctc && needs.ctc-open.outputs.changeCaseId)) }}
    runs-on: ${{ inputs.runsOn }}
    env:
      INPUTS_PACKAGE_MANAGER: ${{ inputs.packageManager }}
      INPUTS_GITHUB_TAG: ${{ inputs.githubTag }}
      INPUTS_TAG: ${{ inputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.githubTag }}
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.nodeVersion }}
          cache: ${{ inputs.packageManager }}
      - name: Install dependencies with yarn
        if: inputs.packageManager == 'yarn'
        uses: salesforcecli/github-workflows/.github/actions/yarnInstallWithRetries@main
      - name: Install dependencies with npm
        if: inputs.packageManager == 'npm'
        uses: salesforcecli/github-workflows/.github/actions/npmInstallWithRetries@main
      - name: Vulnerability check
        if: inputs.vulnerabilityCheck
        # Temporary check for known vulnerable packages from the following supply chain attacks:
        run: |
          vulns=(
            # https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack
            # Last updated 10:33 a.m. ET on September 9, 2025
            "@coveops/abi@2.0.1"
            "@duckdb/duckdb-wasm@1.29.2"
            "@duckdb/node-api@1.3.3"
            "@duckdb/node-bindings@1.3.3"
            "ansi-regex@6.2.1"
            "ansi-styles@6.2.2"
            "backslash@0.2.1"
            "chalk@5.6.1"
            "chalk-template@1.1.1"
            "color@5.0.1"
            "color-convert@3.1.1"
            "color-name@2.0.1"
            "color-string@2.1.1"
            "debug@4.4.2"
            "duckdb@1.3.3"
            "error-ex@1.3.3"
            "has-ansi@6.0.1"
            "is-arrayish@0.3.3"
            "prebid@10.9.2"
            "prebid-universal-creative@1.17.3"
            "prebid.js@10.9.2"
            "proto-tinker-wc@0.1.87"
            "simple-swizzle@0.2.3"
            "slice-ansi@7.1.1"
            "strip-ansi@7.1.1"
            "supports-color@10.2.1"
            "supports-hyperlinks@4.1.1"
            "wrap-ansi@9.0.1"
            # https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages
            # Last updated 10:40 a.m. ET on September 16, 2025
            "angulartics2@14.1.2"
            "@ctrl/deluge@7.2.2"
            "@ctrl/golang-template@1.4.3"
            "@ctrl/magnet-link@4.0.4"
            "@ctrl/ngx-codemirror@7.0.2"
            "@ctrl/ngx-csv@6.0.2"
            "@ctrl/ngx-emoji-mart@9.2.2"
            "@ctrl/ngx-rightclick@4.0.2"
            "@ctrl/qbittorrent@9.7.2"
            "@ctrl/react-adsense@2.0.2"
            "@ctrl/shared-torrent@6.3.2"
            "@ctrl/tinycolor@4.1.1"
            "@ctrl/tinycolor@4.1.2"
            "@ctrl/torrent-file@4.1.2"
            "@ctrl/transmission@7.3.1"
            "@ctrl/ts-base32@4.0.2"
            "encounter-playground@0.0.5"
            "json-rules-engine-simplified@0.2.1"
            "json-rules-engine-simplified@0.2.4"
            "koa2-swagger-ui@5.11.1"
            "koa2-swagger-ui@5.11.2"
            "@nativescript-community/gesturehandler@2.0.35"
            "@nativescript-community/sentry 4.6.43"
            "@nativescript-community/text@1.6.13"
            "@nativescript-community/ui-collectionview@6.0.6"
            "@nativescript-community/ui-drawer@0.1.30"
            "@nativescript-community/ui-image@4.5.6"
            "@nativescript-community/ui-material-bottomsheet@7.2.72"
            "@nativescript-community/ui-material-core@7.2.76"
            "@nativescript-community/ui-material-core-tabs@7.2.76"
            "ngx-color@10.0.2"
            "ngx-toastr@19.0.2"
            "ngx-trend@8.0.1"
            "react-complaint-image@0.0.35"
            "react-jsonschema-form-conditionals@0.3.21"
            "react-jsonschema-form-extras@1.0.4"
            "rxnt-authentication@0.0.6"
            "rxnt-healthchecks-nestjs@1.0.5"
            "rxnt-kue@1.0.7"
            "swc-plugin-component-annotate@1.9.2"
            "ts-gaussian@3.0.6"
            # https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages
            # Last updated 10:40 a.m. ET on September 16, 2025
            "@crowdstrike/commitlint@8.1.1"
            "@crowdstrike/commitlint@8.1.2"
            "@crowdstrike/falcon-shoelace@0.4.2"
            "@crowdstrike/foundry-js@0.19.2"
            "@crowdstrike/glide-core@0.34.2"
            "@crowdstrike/glide-core@0.34.3"
            "@crowdstrike/logscale-dashboard@1.205.2"
            "@crowdstrike/logscale-file-editor@1.205.2"
            "@crowdstrike/logscale-parser-edit@1.205.1"
            "@crowdstrike/logscale-parser-edit@1.205.2"
            "@crowdstrike/logscale-search@1.205.2"
            "@crowdstrike/tailwind-toucan-base@5.0.2"
            "browser-webdriver-downloader@3.0.8"
            "ember-browser-services@5.0.3"
            "ember-headless-form-yup@1.0.1"
            "ember-headless-form@1.1.3"
            "ember-headless-table@2.1.6"
            "ember-url-hash-polyfill@1.0.13"
            "ember-velcro@2.2.2"
            "eslint-config-crowdstrike-node@4.0.4"
            "eslint-config-crowdstrike@11.0.3"
            "monorepo-next@13.0.2"
            "remark-preset-lint-crowdstrike@4.0.2"
            "verror-extra@6.0.1"
            "yargs-help-output@5.0.3"
          )

          for vuln in "${vulns[@]}"; do
            if [[ -n $(npm ls --depth=99 --parseable "$vuln") ]]; then
              echo "VULNERABILITY FOUND: $vuln"
              exit 1
            else
              echo "Known vulnerability not found: $vuln"
            fi
          done

          # Known string from the exploit
          # https://github.com/chalk/chalk/issues/656#issuecomment-3266880534
          strings=(
            "_0x112fa8"
          )

          for str in "${strings[@]}"; do
            if grep -r "$str" --include='*.js' .; then
              echo "VULNERABILITY FOUND: string '$str' found in js files"
              exit 1
            else
              echo "String '$str' not found in js files"
            fi
          done
      - run: $INPUTS_PACKAGE_MANAGER run build
      - run: npm install -g @salesforce/plugin-release-management
      - name: NPM Release
        run: |
          sf-release npm:package:release \
            --githubtag "$INPUTS_GITHUB_TAG" \
            --npmtag "$INPUTS_TAG" \
            --no-install \
            ${{ inputs.dryrun && '--dryrun' || '' }} \
            ${{ inputs.prerelease && format('--prerelease {0}', github.ref_name) || '' }} \
            ${{ inputs.sign && '--sign' || '' }}
        working-directory: ${{ inputs.packagePath }}
        env:
          NPM_TOKEN: ${{secrets.NPM_TOKEN}}
          AWS_ACCESS_KEY_ID: ${{secrets.AWS_ACCESS_KEY_ID}}
          AWS_SECRET_ACCESS_KEY: ${{secrets.AWS_SECRET_ACCESS_KEY}}

  ctcCloseSuccess:
    needs: [ctc-open, npm-publish]
    if: needs.ctc-open.result == 'success' && needs.npm-publish.result == 'success' && needs.ctc-open.outputs.changeCaseId
    uses: salesforcecli/github-workflows/.github/workflows/ctcClose.yml@main
    secrets: inherit
    with:
      changeCaseId: ${{needs.ctc-open.outputs.changeCaseId}}

  ctcCloseFail:
    needs: [ctc-open, npm-publish]
    if: always() && inputs.ctc && needs.ctc-open.outputs.changeCaseId && (needs.ctc-open.result != 'success' || needs.npm-publish.result != 'success')
    uses: salesforcecli/github-workflows/.github/workflows/ctcClose.yml@main
    secrets: inherit
    with:
      changeCaseId: ${{ needs.ctc-open.outputs.changeCaseId }}
      status: Not Implemented