refactor(github-actions): move publish-ci logic to custom GHA action

.github/workflows/reusable-release.yml

@@ -14,6 +14,9 @@ on:
       wombot-token:
         description: 'The Wombat release-backed publish token'
         required: true
+      angular-robot-key:
+        description: 'The private key for the Angular Robot Github app'
+        required: true
 
 permissions: {}
 
@@ -113,7 +116,7 @@ jobs:
     needs: [build, approve]
     runs-on: ubuntu-latest
     permissions:
-      contents: write # Required for ng-dev to create GitHub releases/tags
+      contents: read
       id-token: write # Required to generate NPM/Sigstore provenance metadata
     steps:
       # Step 1: Checkout dev-infra dynamically at the same ref to get the custom actions
@@ -136,7 +139,10 @@ jobs:
           name: release-packages
           path: dist/packages-dist/
 
-      - name: Run ng-dev CI publish
-        env:
-          WOMBOT_TOKEN: ${{ secrets.wombot-token }}
-        run: pnpm ng-dev release publish-ci --built-packages-dir=dist/packages-dist/ --expected-sha=${{ github.sha }}
+      - name: Run ng-dev CI publish (via custom action)
+        uses: ./.dev-infra/github-actions/release/publish
+        with:
+          angular-robot-key: ${{ secrets.angular-robot-key }}
+          wombot-token: ${{ secrets.wombot-token }}
+          built-packages-dir: dist/packages-dist/
+          expected-sha: ${{ github.sha }}

.prettierignore

@@ -12,6 +12,7 @@ github-actions/labeling/pull-request/main.js
 github-actions/google-internal-tests/main.js
 github-actions/org-file-sync/main.js
 github-actions/post-approval-changes/main.js
+github-actions/release/publish/main.js
 github-actions/previews/pack-and-upload-artifact/inject-artifact-metadata.js
 github-actions/previews/pack-and-upload-artifact/remove-preview-label.js
 github-actions/previews/upload-artifacts-to-firebase/extract-artifact-metadata.js

github-actions/release/publish/BUILD.bazel

@@ -0,0 +1,71 @@
+load("@devinfra_npm//:defs.bzl", "npm_link_all_packages")
+load("//tools:defaults.bzl", "esbuild_checked_in", "jasmine_test", "ts_project")
+
+package(default_visibility = ["//github-actions/release/publish:__subpackages__"])
+
+npm_link_all_packages()
+
+ts_project(
+    name = "lib",
+    srcs = [
+        "lib/main.ts",
+        "lib/publish-ci.ts",
+    ],
+    tsconfig = "//github-actions:tsconfig",
+    deps = [
+        "//github-actions:utils",
+        "//github-actions/release/publish:node_modules/@actions/core",
+        "//github-actions/release/publish:node_modules/@types/node",
+        "//github-actions/release/publish:node_modules/@types/semver",
+        "//github-actions/release/publish:node_modules/semver",
+        "//ng-dev/release/config",
+        "//ng-dev/release/notes",
+        "//ng-dev/release/publish",
+        "//ng-dev/release/versioning",
+        "//ng-dev/utils",
+    ],
+)
+
+esbuild_checked_in(
+    name = "main",
+    srcs = [
+        ":lib",
+    ],
+    entry_point = "lib/main.ts",
+    format = "esm",
+    platform = "node",
+    target = "node24",
+)
+
+ts_project(
+    name = "test_lib",
+    testonly = True,
+    srcs = ["lib/publish-ci.spec.ts"],
+    tsconfig = "//github-actions:tsconfig_test",
+    deps = [
+        ":lib",
+        "//github-actions:utils",
+        "//github-actions/release/publish:node_modules/@types/jasmine",
+        "//github-actions/release/publish:node_modules/@types/node",
+        "//github-actions/release/publish:node_modules/@types/semver",
+        "//github-actions/release/publish:node_modules/semver",
+        "//ng-dev/release/config",
+        "//ng-dev/release/notes",
+        "//ng-dev/release/publish/test:test_lib",
+        "//ng-dev/release/versioning",
+        "//ng-dev/utils",
+        "//ng-dev/utils/testing",
+    ],
+)
+
+jasmine_test(
+    name = "test",
+    data = [
+        ":test_lib",
+    ],
+    env = {
+        "GIT_BIN": "$(GIT_BIN_PATH)",
+    },
+    shard_count = 4,
+    toolchains = ["@devinfra//bazel/git-toolchain:current_git_toolchain"],
+)

github-actions/release/publish/action.yml

@@ -0,0 +1,23 @@
+name: 'Release Publish CI'
+description: 'Publishes a release to Wombat (NPM) and creates GitHub tags/releases using the Angular Robot App.'
+author: 'Angular'
+inputs:
+  angular-robot-key:
+    description: 'The private key for the Angular Robot Github app.'
+    required: true
+  wombot-token:
+    description: 'The Wombat release-backed publish token.'
+    required: true
+  built-packages-dir:
+    description: 'Path to the directory containing pre-built packages.'
+    required: true
+  expected-sha:
+    description: 'The expected Git SHA of the release commit.'
+    required: true
+  dry-run:
+    description: 'Run the publish command in dry-run mode, skipping tag/release creation and NPM publishing.'
+    required: false
+    default: 'false'
+runs:
+  using: 'node24'
+  main: 'main.js'

github-actions/release/publish/lib/main.ts

@@ -0,0 +1,48 @@
+import * as core from '@actions/core';
+import {getAuthTokenFor, ANGULAR_ROBOT} from '../../../utils.js';
+import {AuthenticatedGitClient} from '../../../../ng-dev/utils/git/authenticated-git-client.js';
+import {getConfig, assertValidGithubConfig} from '../../../../ng-dev/utils/config.js';
+import {assertValidReleaseConfig} from '../../../../ng-dev/release/config/index.js';
+import {PublishCiTool} from './publish-ci.js';
+
+async function run() {
+  try {
+    const token = await getAuthTokenFor(ANGULAR_ROBOT);
+    core.setSecret(token);
+
+    const wombotToken = core.getInput('wombot-token', {required: true});
+    process.env['WOMBOT_TOKEN'] = wombotToken;
+
+    core.info('Configuring AuthenticatedGitClient with generated token...');
+    AuthenticatedGitClient.configure(token, 'bot');
+
+    core.info('Loading repository configuration...');
+    const config = await getConfig();
+    assertValidReleaseConfig(config);
+    assertValidGithubConfig(config);
+
+    core.info('Initializing Git client...');
+    const git = await AuthenticatedGitClient.get();
+
+    core.info('Starting PublishCiTool...');
+    const tool = new PublishCiTool(config, git, git.baseDir, {
+      builtPackagesDir: core.getInput('built-packages-dir', {required: true}),
+      expectedSha: core.getInput('expected-sha', {required: true}),
+      dryRun: core.getBooleanInput('dry-run', {required: false}),
+    });
+
+    await tool.run();
+    core.info('Release Publish CI completed successfully.');
+  } catch (e) {
+    if (e instanceof Error) {
+      core.setFailed(e.message);
+      if (e.stack) {
+        core.debug(e.stack);
+      }
+    } else {
+      core.setFailed(`Unknown error: ${e}`);
+    }
+  }
+}
+
+await run();

ng-dev/release/publish/test/publish-ci.spec.ts → github-actions/release/publish/lib/publish-ci.spec.ts

@@ -6,26 +6,26 @@
  * found in the LICENSE file at https://angular.io/license
  */
 
-import {PublishCiTool} from '../index-ci.js';
-import {ReleaseConfig} from '../../config/index.js';
-import {GithubConfig, setConfig} from '../../../utils/config.js';
+import {PublishCiTool} from './publish-ci.js';
+import {ReleaseConfig} from '../../../../ng-dev/release/config/index.js';
+import {GithubConfig, setConfig} from '../../../../ng-dev/utils/config.js';
 import {
   getMockGitClient,
   installSandboxGitClient,
   SandboxGitRepo,
   testTmpDir,
   runGitInTmpDir,
-} from '../../../utils/testing/index.js';
-import {prepareTempDirectory} from './test-utils/action-mocks.js';
-import {fakeNpmPackageQueryRequest} from './test-utils/test-utils.js';
-import {ReleaseNotes} from '../../notes/release-notes.js';
-import {NpmCommand} from '../../versioning/npm-command.js';
-import {ActiveReleaseTrains} from '../../versioning/active-release-trains.js';
-import {ReleaseTrain} from '../../versioning/release-trains.js';
+} from '../../../../ng-dev/utils/testing/index.js';
+import {prepareTempDirectory} from '../../../../ng-dev/release/publish/test/test-utils/action-mocks.js';
+import {fakeNpmPackageQueryRequest} from '../../../../ng-dev/release/publish/test/test-utils/test-utils.js';
+import {ReleaseNotes} from '../../../../ng-dev/release/notes/release-notes.js';
+import {NpmCommand} from '../../../../ng-dev/release/versioning/npm-command.js';
+import {ActiveReleaseTrains} from '../../../../ng-dev/release/versioning/active-release-trains.js';
+import {ReleaseTrain} from '../../../../ng-dev/release/versioning/release-trains.js';
 import semver from 'semver';
 import * as fs from 'fs';
 import * as path from 'path';
-import {Log} from '../../../utils/logging.js';
+import {Log} from '../../../../ng-dev/utils/logging.js';
 
 class RequestError extends Error {
   request = {};

ng-dev/release/publish/index-ci.ts → github-actions/release/publish/lib/publish-ci.ts

@@ -18,19 +18,26 @@ import {
 } from 'fs';
 import {tmpdir} from 'os';
 import semver from 'semver';
-import {ReleaseConfig, BuiltPackage, BuiltPackageWithInfo} from '../config/index.js';
-import {analyzeAndExtendBuiltPackagesWithInfo} from './built-package-info.js';
-import {GithubConfig, NgDevConfig} from '../../utils/config.js';
-import {AuthenticatedGitClient} from '../../utils/git/authenticated-git-client.js';
-import {ReleaseNotes, workspaceRelativeChangelogPath} from '../notes/release-notes.js';
-import {NpmCommand} from '../versioning/npm-command.js';
-import {getFileContentsUrl} from '../../utils/git/github-urls.js';
-import {isGithubApiError} from '../../utils/git/github.js';
-import {githubReleaseBodyLimit} from './constants.js';
-import {green, Log} from '../../utils/logging.js';
-import {fetchLongTermSupportBranchesFromNpm} from '../versioning/long-term-support.js';
-import {ActiveReleaseTrains} from '../versioning/active-release-trains.js';
-import {NpmDistTag} from '../versioning/npm-registry.js';
+import {
+  ReleaseConfig,
+  BuiltPackage,
+  BuiltPackageWithInfo,
+} from '../../../../ng-dev/release/config/index.js';
+import {analyzeAndExtendBuiltPackagesWithInfo} from '../../../../ng-dev/release/publish/built-package-info.js';
+import {GithubConfig, NgDevConfig} from '../../../../ng-dev/utils/config.js';
+import {AuthenticatedGitClient} from '../../../../ng-dev/utils/git/authenticated-git-client.js';
+import {
+  ReleaseNotes,
+  workspaceRelativeChangelogPath,
+} from '../../../../ng-dev/release/notes/release-notes.js';
+import {NpmCommand} from '../../../../ng-dev/release/versioning/npm-command.js';
+import {getFileContentsUrl} from '../../../../ng-dev/utils/git/github-urls.js';
+import {isGithubApiError} from '../../../../ng-dev/utils/git/github.js';
+import {githubReleaseBodyLimit} from '../../../../ng-dev/release/publish/constants.js';
+import {green, Log} from '../../../../ng-dev/utils/logging.js';
+import {fetchLongTermSupportBranchesFromNpm} from '../../../../ng-dev/release/versioning/long-term-support.js';
+import {ActiveReleaseTrains} from '../../../../ng-dev/release/versioning/active-release-trains.js';
+import {NpmDistTag} from '../../../../ng-dev/release/versioning/npm-registry.js';
 
 /** Options for configuring the PublishCiTool. */
 export interface PublishCiToolOptions {