From 756e9507b3c86eb70f9dd00fe243689828620003 Mon Sep 17 00:00:00 2001
From: Amy Galles <9685081+AmyLGalles@users.noreply.github.com>
Date: Thu, 30 Jul 2026 12:06:33 -0700
Subject: [PATCH] [BRE-1935] Phase 2: Convert cd.yml to trigger-actions caller

This converts the cd.yml workflow from the old passwordless-devops dispatch
pattern to the new trigger-actions deployment event pattern, dispatching to
bitwarden/deploy's deploy-passwordless-nodejs.yml receiver workflow.

Changes:
- Replaced passwordless-devops gh workflow run dispatch with trigger-actions
- Removed BW-GHAPP token generation (no longer needed)
- Switched keyvault from gh-org-bitwarden to trigger-actions' internal handling
- Updated action versions (checkout v7.0.0, setup-node v6.3.0)
- Renamed deploy job to trigger-deploy for clarity
- Split deploy job into separate build and trigger-deploy jobs
- Moved artifact upload to build job (runs before trigger)
- Added workflow-level permissions: {}

The build and lint jobs remain in the source repo; deployment logic now lives
in bitwarden/deploy following the BRE-1935 centralization pattern.

This completes Phase 2 (finalize-source) of the BRE-1935 migration.
Phase 3 (wire trigger-actions.yml receiver) is next.
---
 .github/workflows/cd.yml | 73 +++++++++++++++-------------------------
 1 file changed, 28 insertions(+), 45 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index ca9c9f0..37f3e38 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -1,5 +1,4 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
+# This workflow triggers deployment to npm via bitwarden/deploy
 
 name: Node.js Package
 
@@ -8,22 +7,22 @@ on:
     types:
       - published
 
+permissions: {}
+
 jobs:
   format:
     name: Format
     runs-on: ubuntu-24.04
-
     permissions:
       contents: read
-
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Install NodeJS
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 20
 
@@ -33,25 +32,20 @@ jobs:
       - name: Run format
         run: npm run lint
 
-  deploy:
-    name: Deploy
-    if: ${{ github.event_name == 'release' }}
+  build:
+    name: Build
     needs: format
     runs-on: ubuntu-24.04
-
     permissions:
-      actions: write
       contents: read
-      id-token: write
-
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Install NodeJS
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 20
 
@@ -69,6 +63,15 @@ jobs:
             dist
             package.json
 
+  trigger-deploy:
+    name: Trigger deployment
+    if: ${{ github.event_name == 'release' }}
+    needs: build
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+    steps:
       - name: Log in to Azure
         uses: bitwarden/gh-actions/azure-login@main
         with:
@@ -76,34 +79,14 @@ jobs:
           tenant_id: ${{ secrets.AZURE_TENANT_ID }}
           client_id: ${{ secrets.AZURE_CLIENT_ID }}
 
-      - name: Get Azure Key Vault secrets
-        id: get-kv-secrets
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
+      - name: Trigger deployment to deploy repo
+        uses: bitwarden/gh-actions/trigger-actions@main
         with:
-          keyvault: gh-org-bitwarden
-          secrets: 'BW-GHAPP-ID,BW-GHAPP-KEY'
-
-      - name: Log out from Azure
-        uses: bitwarden/gh-actions/azure-logout@main
-
-      - name: Generate GH App token
-        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
-        id: app-token
-        with:
-          app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
-          private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}
-          owner: bitwarden
-          repositories: passwordless-devops
-
-      - name: Dispatch deployment
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-          TAG_NAME: ${{ github.event.release.tag_name }}
-        run: >
-          gh workflow run deploy-passwordless-nodejs
-          --repo bitwarden/passwordless-devops
-          --field repository="${{ github.repository }}"
-          --field run-id="${{ github.run_id }}"
-          --field artifact="packages"
-          --field environment="npm"
-          --field version="${TAG_NAME}"
+          azure_subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          azure_tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          azure_client_id: ${{ secrets.AZURE_CLIENT_ID }}
+          task: deploy-passwordless-nodejs
+          data: |
+            {
+              "tag": "${{ github.event.release.tag_name }}"
+            }