ci: add @bazel/runfiles OSS Exit Gate npm publishing job

.github/workflows/release.yml

@@ -29,3 +29,120 @@ jobs:
       tag_name: ${{ inputs.tag_name || github.ref_name }}
     secrets:
       BCR_PUBLISH_TOKEN: ${{ secrets.BCR_PUBLISH_TOKEN }}
+
+  publish-npm:
+    needs: release
+    runs-on: ubuntu-latest
+    concurrency:
+      group: publish-npm-${{ inputs.tag_name || github.ref_name }}
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ inputs.tag_name || github.ref }}
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: 20
+
+      - name: Set up Cloud SDK
+        uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f
+        with:
+          version: '509.0.0'
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed
+        with:
+          workload_identity_provider: 'projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github'
+
+      - name: Clean up failed staging attempt for this exact version (if any)
+        env:
+          TAG_NAME: ${{ inputs.tag_name || github.ref_name }}
+        run: |
+          set -euo pipefail
+          VERSION="${TAG_NAME#v}"
+          set +e
+          PENDING=$(gcloud storage ls \
+            "gs://oss-exit-gate-prod-projects-bucket/rules-nodejs/npm/manifests/manifest-${VERSION}-*.json" \
+            2> ls.err)
+          LS_RC=$?
+          set -e
+          if [ $LS_RC -eq 0 ] && [ -n "${PENDING}" ]; then
+            echo "Manifest for version ${VERSION} already submitted (${PENDING}) — skipping staging cleanup"
+            echo "skip_stage=true" >> "$GITHUB_ENV"
+            exit 0
+          elif [ $LS_RC -ne 0 ] && ! grep -qi "matched no objects" ls.err; then
+            cat ls.err >&2
+            exit $LS_RC
+          fi
+
+          set +e
+          gcloud artifacts versions describe "${VERSION}" \
+            --package="@bazel/runfiles" \
+            --project="oss-exit-gate-prod" \
+            --location="us" \
+            --repository="rules-nodejs--npm" \
+            --format="value(name)" > /dev/null 2> describe.err
+          DESC_RC=$?
+          set -e
+          if [ $DESC_RC -eq 0 ]; then
+            echo "Deleting incomplete staged version ${VERSION} before retry..."
+            gcloud artifacts versions delete "${VERSION}" \
+              --package="@bazel/runfiles" \
+              --project="oss-exit-gate-prod" \
+              --location="us" \
+              --repository="rules-nodejs--npm" \
+              --quiet
+          elif grep -Eqi "NOT_FOUND:.*(Version|versions/${VERSION}|Package|packages/)" describe.err; then
+            echo "Version ${VERSION} not present in staging repository — proceeding with fresh upload"
+          else
+            cat describe.err >&2
+            exit $DESC_RC
+          fi
+
+      - name: Build and stage @bazel/runfiles to OSS Exit Gate
+        if: env.skip_stage != 'true'
+        env:
+          TAG_NAME: ${{ inputs.tag_name || github.ref_name }}
+          RUN_ID: ${{ github.run_id }}
+          RUN_ATTEMPT: ${{ github.run_attempt }}
+        run: |
+          set -euo pipefail
+          VERSION="${TAG_NAME#v}"
+          case "${VERSION}" in
+            *-*) NPM_TAG="next" ;;
+            *)   NPM_TAG="latest" ;;
+          esac
+          bazel build //packages/runfiles:npm_package
+          PKG_DIR="$(bazel info bazel-bin)/packages/runfiles/npm_package"
+          chmod -R u+w "$PKG_DIR"
+          npm --prefix "$PKG_DIR" version "$VERSION" --no-git-tag-version --allow-same-version
+          cat << 'EOF' > "$PKG_DIR/.npmrc"
+          registry=https://us-npm.pkg.dev/oss-exit-gate-prod/rules-nodejs--npm/
+          //us-npm.pkg.dev/oss-exit-gate-prod/rules-nodejs--npm/:always-auth=true
+          EOF
+          npx --yes google-artifactregistry-auth --repo-config="$PKG_DIR/.npmrc" --credential-config="$HOME/.npmrc"
+          npm publish "$PKG_DIR" --tag "${NPM_TAG}" --registry="https://us-npm.pkg.dev/oss-exit-gate-prod/rules-nodejs--npm/" --provenance=false
+          cat << EOF > manifest.json
+          {
+            "publish_all": false,
+            "publishing_groups": [
+              {
+                "packages": [
+                  {
+                    "name": "@bazel/runfiles",
+                    "version": "${VERSION}"
+                  }
+                ]
+              }
+            ]
+          }
+          EOF
+          gcloud storage cp manifest.json \
+            "gs://oss-exit-gate-prod-projects-bucket/rules-nodejs/npm/manifests/manifest-${VERSION}-${RUN_ID}-${RUN_ATTEMPT}.json"