diff --git a/.github/workflows/build-node-packages.yml b/.github/workflows/build-node-packages.yml index 8b3cd4a7087318..1b01f2147b81e9 100644 --- a/.github/workflows/build-node-packages.yml +++ b/.github/workflows/build-node-packages.yml @@ -30,6 +30,10 @@ jobs: env: NODE_VERSION: v22.21.1 + PLATFORM: ${{ matrix.platform }} + ARCH: ${{ matrix.arch }} + BAZEL_ARCH: ${{ matrix.bazel_arch }} + REPO: ${{ github.repository }} steps: - name: Checkout repository @@ -37,17 +41,18 @@ jobs: - name: Debug Matrix Values run: | - echo "Matrix platform: ${{ matrix.platform }}" - echo "Matrix arch: ${{ matrix.arch }}" + echo "Matrix platform: $PLATFORM" + echo "Matrix arch: $ARCH" - name: Download Node archive - run: | - gh release download node-${{ env.NODE_VERSION }}-release \ - --repo asana/node \ - --pattern "node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz" - mv node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz node.tar.xz env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + ASSET="node-${NODE_VERSION}-${PLATFORM}-${ARCH}-LATEST.tar.xz" + gh release download "node-${NODE_VERSION}-release" \ + --repo asana/node \ + --pattern "$ASSET" + mv "$ASSET" node.tar.xz - name: Execute the Dockerfile run: | @@ -70,16 +75,20 @@ jobs: mv node_modules/cld ./cld@2.9.1/node_modules/ mv node_modules/unix-dgram ./unix-dgram@2.0.6/node_modules/ mv "node_modules/@datadog/pprof" "./@datadog+pprof@5.8.0/node_modules/@datadog/" - tar --hard-dereference -cvzf packages_${{matrix.arch}}.tar.gz bcrypt@5.1.0 cld@2.9.1 unix-dgram@2.0.6 "@datadog+pprof@5.8.0" + tar --hard-dereference -cvzf "packages_${ARCH}.tar.gz" bcrypt@5.1.0 cld@2.9.1 unix-dgram@2.0.6 "@datadog+pprof@5.8.0" - name: Upload archive to release - uses: softprops/action-gh-release@v1 - with: - name: node-${{ env.NODE_VERSION }}-LATEST - tag_name: node-${{ env.NODE_VERSION }}-release - files: packages_${{matrix.arch}}.tar.gz + # Use `gh release upload` (first-party GitHub CLI, pre-installed on runners) + # instead of softprops/action-gh-release (one-maintainer third-party action). + # Behavior: --clobber overwrites an existing asset with the same name, matching + # softprops's default. The release must already exist (created by build-node.yml). env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh release upload "node-${NODE_VERSION}-release" \ + "packages_${ARCH}.tar.gz" \ + --clobber \ + --repo "$REPO" # S3 upload is restricted to the protected main branch only. The IAM role # (push_node_gyp_packages) trusts only refs/heads/main via OIDC. To upload @@ -94,14 +103,45 @@ jobs: - name: Upload packages to S3 if: github.ref == 'refs/heads/main' run: | - NODE_MAJOR=$(echo "${{ env.NODE_VERSION }}" | sed 's/^v//' | cut -d. -f1) - SHA256=$(sha256sum "packages_${{ matrix.arch }}.tar.gz" | awk '{print $1}') + # Upload to s3://asana-oss-cache/node-gyp/... (CloudFront path_patterns entry + # added in codez PR #390222 — that must be merged + applied via Spacelift + # before this workflow can successfully publish fetchable objects). + # + # No --acl public-read: the bucket has BucketOwnerEnforced + # (disable_confusing_acls = true), which disables ACLs entirely. + # BlockPublicAcls + IgnorePublicAcls provide additional coverage. + # Reads come via CloudFront OAC. + NODE_MAJOR=$(echo "$NODE_VERSION" | sed 's/^v//' | cut -d. -f1) + SHA256=$(sha256sum "packages_${ARCH}.tar.gz" | awk '{print $1}') SHORT_HASH=${SHA256:0:8} - S3_KEY="node-gyp/packages_${{ matrix.bazel_arch }}_node${NODE_MAJOR}-${SHORT_HASH}.tar.gz" - echo "Uploading packages_${{ matrix.arch }}.tar.gz to s3://asana-oss-cache/${S3_KEY}" - aws s3 cp "packages_${{ matrix.arch }}.tar.gz" "s3://asana-oss-cache/${S3_KEY}" --acl public-read + S3_KEY="node-gyp/packages_${BAZEL_ARCH}_node${NODE_MAJOR}-${SHORT_HASH}.tar.gz" + echo "Uploading packages_${ARCH}.tar.gz to s3://asana-oss-cache/$S3_KEY" + aws s3 cp "packages_${ARCH}.tar.gz" "s3://asana-oss-cache/$S3_KEY" + { + echo "S3_KEY=$S3_KEY" + echo "SHA256=$SHA256" + echo "NODE_MAJOR=$NODE_MAJOR" + } >> "$GITHUB_ENV" + + - name: Verify upload is reachable via CloudFront + if: github.ref == 'refs/heads/main' + run: | + # Mac Bazel builds rewrite asana-oss-cache.s3.us-east-1.amazonaws.com/* + # to asana-oss-cache.asana.biz/* (CloudFront). If the S3 key prefix isn't + # allowlisted in CloudFront's path_patterns, Bazel fetches will 403. + # Fail fast here rather than after someone tries to build. + URL="https://asana-oss-cache.asana.biz/$S3_KEY" + echo "Checking $URL" + if ! curl -fsSI "$URL"; then + echo "CloudFront returned an error for $URL. Check path_patterns in system_packages.tf." + exit 1 + fi + + - name: Print tools_repositories.bzl stanza + if: github.ref == 'refs/heads/main' + run: | echo "" echo "=== Update tools_repositories.bzl in codez ===" - echo " name = \"node_gyp_packages_${{ matrix.bazel_arch }}_node${NODE_MAJOR}\"," - echo " urls = [\"https://asana-oss-cache.s3.us-east-1.amazonaws.com/${S3_KEY}\"]," - echo " sha256 = \"${SHA256}\"," + echo " name = \"node_gyp_packages_${BAZEL_ARCH}_node${NODE_MAJOR}\"," + echo " urls = [\"https://asana-oss-cache.s3.us-east-1.amazonaws.com/$S3_KEY\"]," + echo " sha256 = \"$SHA256\"," diff --git a/stage_for_s3.bash b/stage_for_s3.bash index 8d9cfdb7c216bc..22ee4c9c62f05c 100755 --- a/stage_for_s3.bash +++ b/stage_for_s3.bash @@ -16,14 +16,15 @@ gh release download -p "*.xz" echo "" echo "=== Native packages (node-gyp) ===" echo "These are uploaded to s3://asana-oss-cache/node-gyp/ by the build-node-packages.yml workflow" -echo "with content-hashed S3 keys. Each build produces an immutable artifact." +echo "(triggered via workflow_dispatch from main) with content-hashed S3 keys." +echo "Each build produces an immutable artifact." for pkg in packages_*.tar.gz; do if [ -f "$pkg" ]; then echo " $pkg: sha256=$(sha256sum "$pkg" | awk '{print $1}')" rm "$pkg" fi done -echo "No manual action needed for packages — they are already in S3." +echo "No manual action needed for packages if you've already dispatched build-node-packages.yml from main." echo "" curl "https://asana-oss-cache.s3.us-east-1.amazonaws.com/node-fibers/fibers-5.0.4.pc.tgz" --output fibers-5.0.4.tar.gz