From d8d1afea6179e2a5d0bf67bae52f8f789a4c32c8 Mon Sep 17 00:00:00 2001 From: Vince Grassia <593223+vgrassia@users.noreply.github.com> Date: Tue, 4 Aug 2026 18:44:59 -0400 Subject: [PATCH 1/3] Add publish.yml workflow --- .github/workflows/publish.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 .github/workflows/publish.yml diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 0000000..43685f6 --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,17 @@ +# Inert publish shim for @passwordlessdev/passwordless-nodejs. +# Do NOT add logic to this file — it is intentionally minimal and managed by BRE. + +name: "Passwordless Node.js: Publish" +on: + workflow_dispatch: {} + +permissions: {} + +jobs: + publish: + name: Publish @passwordlessdev/passwordless-nodejs to npm + permissions: + contents: read + id-token: write + uses: bitwarden/gh-actions/.github/workflows/_publish-passwordless-nodejs-npm.yml@main + From 5530d96a5e4be31a1a8edc04baade2e8fd5ec9c1 Mon Sep 17 00:00:00 2001 From: Vince Grassia <593223+vgrassia@users.noreply.github.com> Date: Tue, 4 Aug 2026 19:29:37 -0400 Subject: [PATCH 2/3] Change logic for CD --- .github/workflows/cd.yml | 87 ++++++++++++++++------------------------ 1 file changed, 34 insertions(+), 53 deletions(-) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index ca9c9f0..6dbbbab 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -1,6 +1,3 @@ -# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created -# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages - name: Node.js Package on: @@ -8,6 +5,8 @@ on: types: - published +permissions: {} + jobs: format: name: Format @@ -33,16 +32,17 @@ jobs: - name: Run format run: npm run lint - deploy: - name: Deploy - if: ${{ github.event_name == 'release' }} + # Attach the CI-built npm bundle to the release so bitwarden/deploy's + # publish-passwordless-nodejs.yml can promote it later. This workflow does NOT publish to + # npm — that step is manually gated in bitwarden/deploy and runs from the public + # publish.yml shim under this repo. + attach-build: + name: Attach npm build to release needs: format runs-on: ubuntu-24.04 permissions: - actions: write - contents: read - id-token: write + contents: write steps: - name: Checkout @@ -58,52 +58,33 @@ jobs: - name: Install dependencies run: npm ci + # Fail fast if the release tag doesn't line up with package.json — the downstream + # publish trusts package.json, so a mismatch here would publish a different version + # than the release advertises. + - name: Verify package.json version matches release tag + env: + RELEASE_TAG: ${{ github.event.release.tag_name }} + run: | + PKG_VERSION=$(jq -r '.version' package.json) + if [[ "$PKG_VERSION" != "$RELEASE_TAG" ]]; then + echo "::error::package.json version '${PKG_VERSION}' does not match release tag '${RELEASE_TAG}'" + exit 1 + fi + - name: Run build run: npm run build - - name: Upload artifacts - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - with: - name: packages - path: | - dist - package.json - - - name: Log in to Azure - uses: bitwarden/gh-actions/azure-login@main - with: - subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - tenant_id: ${{ secrets.AZURE_TENANT_ID }} - client_id: ${{ secrets.AZURE_CLIENT_ID }} - - - name: Get Azure Key Vault secrets - id: get-kv-secrets - uses: bitwarden/gh-actions/get-keyvault-secrets@main - with: - keyvault: gh-org-bitwarden - secrets: 'BW-GHAPP-ID,BW-GHAPP-KEY' - - - name: Log out from Azure - uses: bitwarden/gh-actions/azure-logout@main - - - name: Generate GH App token - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4 - id: app-token - with: - app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }} - private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }} - owner: bitwarden - repositories: passwordless-devops + - name: Zip build + env: + RELEASE_TAG: ${{ github.event.release.tag_name }} + run: | + zip -r "passwordless-nodejs-${RELEASE_TAG}-npm-build.zip" dist - - name: Dispatch deployment + - name: Upload zip as release asset env: - GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} - TAG_NAME: ${{ github.event.release.tag_name }} - run: > - gh workflow run deploy-passwordless-nodejs - --repo bitwarden/passwordless-devops - --field repository="${{ github.repository }}" - --field run-id="${{ github.run_id }}" - --field artifact="packages" - --field environment="npm" - --field version="${TAG_NAME}" + GH_TOKEN: ${{ github.token }} + RELEASE_TAG: ${{ github.event.release.tag_name }} + run: | + gh release upload "${RELEASE_TAG}" \ + "passwordless-nodejs-${RELEASE_TAG}-npm-build.zip" \ + --clobber From 0563666de5ae888043575db5508e8355836fcf4e Mon Sep 17 00:00:00 2001 From: Vince Grassia <593223+vgrassia@users.noreply.github.com> Date: Tue, 4 Aug 2026 19:59:31 -0400 Subject: [PATCH 3/3] Fix comments --- .github/workflows/cd.yml | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 6dbbbab..88c761e 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -33,9 +33,7 @@ jobs: run: npm run lint # Attach the CI-built npm bundle to the release so bitwarden/deploy's - # publish-passwordless-nodejs.yml can promote it later. This workflow does NOT publish to - # npm — that step is manually gated in bitwarden/deploy and runs from the public - # publish.yml shim under this repo. + # publish-passwordless-nodejs.yml can promote it later. attach-build: name: Attach npm build to release needs: format @@ -58,9 +56,6 @@ jobs: - name: Install dependencies run: npm ci - # Fail fast if the release tag doesn't line up with package.json — the downstream - # publish trusts package.json, so a mismatch here would publish a different version - # than the release advertises. - name: Verify package.json version matches release tag env: RELEASE_TAG: ${{ github.event.release.tag_name }}