ci: migrate NPM package publishing from Wombat to OSS Exit Gate (#1773)

.github/workflows/lerna-publish.yml

@@ -1,3 +1,4 @@
+# Publish NPM packages via OSS Exit Gate (D11: looker-sdk-codegen/npm — b/576685161, b/576678670).
 name: Publish NPM Packages
 
 on:
@@ -10,10 +11,13 @@ on:
         description: 'commit/tag/branch to release from'
         required: true
 
+permissions: read-all
+
 jobs:
   publish:
     permissions:
       contents: read
+      id-token: write
     if: >
       (github.event.inputs) ||
       (startsWith(github.event.release.tag_name, 'sdk-codegen-all') &&
@@ -25,14 +29,17 @@ jobs:
       LOOKERSDK_VERIFY_SSL: false
       LOOKERSDK_CLIENT_ID: ${{ secrets.LOOKERSDK_CLIENT_ID }}
       LOOKERSDK_CLIENT_SECRET: ${{ secrets.LOOKERSDK_CLIENT_SECRET }}
+      WIF_PROVIDER: 'projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github'
+      EXIT_GATE_AR_URL: 'https://us-npm.pkg.dev/oss-exit-gate-prod/looker-sdk-codegen--npm/'
+      EXIT_GATE_MANIFEST_GCS: 'gs://oss-exit-gate-prod-projects-bucket/looker-sdk-codegen/npm/manifests'
     steps:
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          ref: ${{  github.event.release.tag_name || github.event.inputs.ref }}
+          ref: ${{ github.event.release.tag_name || github.event.inputs.ref }}
 
-      - name: Authenticate to Google Cloud
+      - name: Authenticate to Google Cloud (CI Docker Image Pull)
         uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         with:
           credentials_json: ${{ secrets.GCP_AR_READER_SA_KEY }}
@@ -82,16 +89,88 @@ jobs:
 
       - name: Check that Looker is ready
         run: |
-          ${{ github.workspace }}/.github/scripts/wait_for_looker.sh
+          ${GITHUB_WORKSPACE}/.github/scripts/wait_for_looker.sh
 
-      - name: Configure Wombat registry
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - name: Authenticate to Google Cloud (OSS Exit Gate WIF)
+        id: exit_gate_auth
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         with:
-          node-version: 24.x
-          registry-url: https://wombat-dressing-room.appspot.com
-          package-manager-cache: false
+          workload_identity_provider: ${{ env.WIF_PROVIDER }}
 
-      - name: Publish to NPM registry
-        run: npx lerna publish from-package --yes --no-verify-access
+      - name: Stage and trigger OSS Exit Gate NPM release
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_RELEASE_BACKED }}
+          ACCESS_TOKEN: ${{ steps.exit_gate_auth.outputs.auth_token }}
+          RUN_ID: ${{ github.run_id }}
+          RUN_ATTEMPT: ${{ github.run_attempt }}
+        run: |
+          set -euo pipefail
+          trap 'rm -f "$HOME/.npmrc" manifest.json' EXIT
+
+          # 1. Run root prepublishOnly check (jest packages/sdk-rtl)
+          yarn prepublishOnly
+
+          # 2. Identify non-private @looker/* packages not yet published on registry.npmjs.org
+          UNPUBLISHED_PKGS="[]"
+          for pkg_json in packages/*/package.json; do
+            PRIVATE=$(jq -r '.private // false' "$pkg_json")
+            NAME=$(jq -r '.name' "$pkg_json")
+            VERSION=$(jq -r '.version' "$pkg_json")
+            PKG_DIR=$(dirname "$pkg_json")
+
+            if [[ "$PRIVATE" == "true" || "$NAME" != @looker/* ]]; then
+              continue
+            fi
+
+            # Check public npm registry before configuring AR .npmrc
+            if npm view "${NAME}@${VERSION}" version --registry https://registry.npmjs.org >/dev/null 2>&1; then
+              echo "Skipping ${NAME}@${VERSION} (already published on npmjs.org)"
+            else
+              echo "Queueing ${NAME}@${VERSION} for staging"
+              SHORT_NAME="${NAME#@looker/}"
+              UNPUBLISHED_PKGS=$(jq -c \
+                --arg dir "$PKG_DIR" \
+                --arg name "$SHORT_NAME" \
+                --arg version "$VERSION" \
+                '. + [{dir: $dir, name: $name, version: $version}]' <<< "$UNPUBLISHED_PKGS")
+            fi
+          done
+
+          COUNT=$(jq 'length' <<< "$UNPUBLISHED_PKGS")
+          if [[ "$COUNT" -eq 0 ]]; then
+            echo "All package versions are already published on npmjs.org. Nothing to release."
+            exit 0
+          fi
+
+          # 3. Configure .npmrc for OSS Exit Gate Artifact Registry
+          AR_HOST_PATH="${EXIT_GATE_AR_URL#https:}"
+          AR_HOST_PATH="${AR_HOST_PATH%/}/"
+          umask 077
+          printf '%s\n' \
+            "@looker:registry=${EXIT_GATE_AR_URL}" \
+            "${AR_HOST_PATH}:_authToken=${ACCESS_TOKEN}" \
+            "${AR_HOST_PATH}:always-auth=true" > "$HOME/.npmrc"
+
+          # 4. Stage only the new package versions to the OSS Exit Gate Artifact Registry
+          for row in $(jq -r '.[] | @base64' <<< "$UNPUBLISHED_PKGS"); do
+            PKG_DIR=$(base64 --decode <<< "$row" | jq -r '.dir')
+            echo "Staging ${PKG_DIR} to ${EXIT_GATE_AR_URL}..."
+            npm publish "./${PKG_DIR}" --registry "${EXIT_GATE_AR_URL}"
+          done
+
+          # 5. Generate and upload manifest.json to trigger OSS Exit Gate
+          jq -n --argjson pkgs "$UNPUBLISHED_PKGS" '{
+            publish_all: false,
+            publishing_groups: [
+              {
+                namespace: "@looker",
+                packages: ($pkgs | map({name: .name, version: .version}))
+              }
+            ]
+          }' > manifest.json
+
+          echo "Generated manifest.json:"
+          cat manifest.json
+
+          unset CLOUDSDK_CORE_PROJECT
+          gcloud storage cp manifest.json \
+            "${EXIT_GATE_MANIFEST_GCS}/manifest-${RUN_ID}-${RUN_ATTEMPT}.json"