fix(release): use fs instead of glob for tarball matching, fix artifact download path

Co-authored-by: neilime <314088+neilime@users.noreply.github.com>
Signed-off-by: Emilien Escalle <emilien.escalle@escemi.com>

Author: Copilot

.github/workflows/release.yml

@@ -15,6 +15,11 @@ on:
         type: string
         default: '["ubuntu-latest"]'
         required: false
+      working-directory:
+        description: "Working directory where the dependencies are installed."
+        type: string
+        required: false
+        default: "."
       build-artifact-id:
         description: |
           Build artifact ID from a previous CI job to download before publishing.
@@ -23,45 +28,6 @@ on:
         type: string
         required: false
         default: ""
-      package-tarball:
-        description: |
-          Path to a pre-built package tarball to publish (e.g., `my-package-1.0.0.tgz`).
-          Use this when publishing a specific tarball file instead of running npm publish from source.
-          Supports glob patterns to match tarball files.
-        type: string
-        required: false
-        default: ""
-      access:
-        description: |
-          Package access level for npm publish.
-          - `public` — Publicly accessible package
-          - `restricted` — Scoped package with restricted access
-          Leave empty to use package.json default.
-        type: string
-        required: false
-        default: ""
-      docs:
-        description: |
-          Documentation generation parameters.
-          Set to empty string or `false` to disable documentation generation.
-          Set to `true` or a string to enable documentation generation with the default command `docs`.
-          Accepts a JSON object for advanced options:
-
-          - `command`: Command to run for documentation generation (default: `docs`).
-          - `output`: Output directory for documentation (default: `docs`).
-          - `artifact`: Whether to upload documentation as an artifact (default: `false`).
-
-          Example:
-          ```json
-          {
-            "command": "build:docs",
-            "output": "docs-dist",
-            "artifact": true
-          }
-          ```
-        type: string
-        required: false
-        default: ""
       registry:
         description: |
           Registry configuration for package publishing.
@@ -85,19 +51,6 @@ on:
         type: string
         required: false
         default: "npm"
-      publish-command:
-        description: |
-          Command to run for publishing the package.
-          Defaults to `publish` which runs `npm publish` or equivalent for the detected package manager.
-          Can be customized for monorepo setups or specific publish requirements.
-
-          Examples:
-          - `publish` — Default npm/pnpm/yarn publish
-          - `release` — Custom publish script in package.json
-          - `publish --access public` — Publish with specific npm flags
-        type: string
-        required: false
-        default: "publish"
       tag:
         description: |
           npm distribution tag for the published package.
@@ -110,43 +63,6 @@ on:
         type: string
         required: false
         default: "latest"
-      dry-run:
-        description: |
-          Whether to perform a dry run (no actual publish).
-          Useful for testing the release workflow without publishing.
-        type: boolean
-        required: false
-        default: false
-      provenance:
-        description: |
-          Whether to generate provenance attestation for the published package.
-          Requires npm 9.5.0+ and appropriate permissions.
-          See https://docs.npmjs.com/generating-provenance-statements.
-        type: boolean
-        required: false
-        default: true
-      working-directory:
-        description: "Working directory where the package is located."
-        type: string
-        required: false
-        default: "."
-    secrets:
-      registry-token:
-        description: |
-          Authentication token for the registry.
-          For npm: Use an npm access token with publish permissions.
-          For GitHub Packages: Use `GITHUB_TOKEN` or a PAT with `packages:write` permission.
-        required: true
-    outputs:
-      version:
-        description: "The version of the published package."
-        value: ${{ jobs.release.outputs.version }}
-      package-name:
-        description: "The name of the published package."
-        value: ${{ jobs.release.outputs.package-name }}
-      docs-artifact-id:
-        description: "ID of the documentation artifact (if uploaded)."
-        value: ${{ jobs.release.outputs.docs-artifact-id }}
 
 permissions: {}
 
@@ -210,47 +126,6 @@ jobs:
             core.setOutput('registry-url', registryUrl);
             core.setOutput('registry-scope', registryScope);
 
-      - id: parse-docs
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          DOCS_INPUT: ${{ inputs.docs }}
-        with:
-          script: |
-            const docsInput = process.env.DOCS_INPUT.trim();
-
-            if (!docsInput || docsInput === 'false') {
-              core.info('Documentation generation disabled');
-              return;
-            }
-
-            let command = 'docs';
-            let output = 'docs';
-            let artifact = false;
-
-            if (docsInput === 'true') {
-              // Use defaults
-            } else if (docsInput.startsWith('{')) {
-              try {
-                const config = JSON.parse(docsInput);
-                command = config.command || 'docs';
-                output = config.output || 'docs';
-                artifact = config.artifact === true;
-              } catch (error) {
-                return core.setFailed(`Failed to parse docs input as JSON: ${error.message}`);
-              }
-            } else {
-              // Treat as custom command
-              command = docsInput;
-            }
-
-            core.info(`Docs command: ${command}`);
-            core.info(`Docs output: ${output}`);
-            core.info(`Docs artifact: ${artifact}`);
-
-            core.setOutput('command', command);
-            core.setOutput('output', output);
-            core.setOutput('artifact', artifact ? 'true' : '');
-
   release:
     name: 🚀 Release
     runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
@@ -260,10 +135,6 @@ jobs:
       contents: read
       packages: write
       id-token: write # Required for provenance
-    outputs:
-      version: ${{ steps.package-info.outputs.version }}
-      package-name: ${{ steps.package-info.outputs.name }}
-      docs-artifact-id: ${{ steps.upload-docs.outputs.artifact-id }}
     steps:
       - uses: hoverkraft-tech/ci-github-common/actions/checkout@5ac504609f6ef35c5ac94bd8199063aa32104721 # 0.31.3
 
@@ -282,8 +153,8 @@ jobs:
         if: inputs.build-artifact-id != ''
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
-          artifact-ids: ${{ inputs.build-artifact-id }}
-          path: /
+          name: ${{ inputs.build-artifact-id }}
+          path: ${{ github.workspace }}
 
       - id: package-info
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@@ -325,53 +196,6 @@ jobs:
             core.setOutput('name', name);
             core.setOutput('version', version);
 
-      - name: Generate documentation
-        if: needs.prepare.outputs.docs-command != ''
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          DOCS_COMMAND: ${{ needs.prepare.outputs.docs-command }}
-          RUN_SCRIPT_COMMAND: ${{ steps.setup-node.outputs.run-script-command }}
-          WORKING_DIRECTORY: ${{ inputs.working-directory }}
-        with:
-          script: |
-            const fs = require('node:fs');
-            const path = require('node:path');
-
-            let workingDirectory = process.env.WORKING_DIRECTORY || '.';
-            if (!path.isAbsolute(workingDirectory)) {
-              workingDirectory = path.join(process.env.GITHUB_WORKSPACE, workingDirectory);
-            }
-
-            if (!fs.existsSync(workingDirectory)) {
-              return core.setFailed(`Working directory does not exist: ${workingDirectory}`);
-            }
-
-            const docsCommand = process.env.DOCS_COMMAND;
-            const runScriptCommand = process.env.RUN_SCRIPT_COMMAND;
-
-            core.info(`Running documentation command: ${docsCommand}`);
-
-            try {
-              const exitCode = await exec.exec(runScriptCommand, [docsCommand], {
-                cwd: workingDirectory,
-                ignoreReturnCode: true
-              });
-
-              if (exitCode !== 0) {
-                return core.setFailed(`Documentation generation failed with exit code ${exitCode}`);
-              }
-            } catch (error) {
-              return core.setFailed(`Documentation generation failed: ${error.message}`);
-            }
-
-      - id: upload-docs
-        if: needs.prepare.outputs.docs-artifact == 'true'
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
-        with:
-          name: documentation-${{ github.run_id }}
-          path: ${{ inputs.working-directory }}/${{ needs.prepare.outputs.docs-output }}
-          if-no-files-found: error
-
       - name: Publish package
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
@@ -389,7 +213,6 @@ jobs:
           script: |
             const fs = require('node:fs');
             const path = require('node:path');
-            const { glob } = require('glob');
 
             let workingDirectory = process.env.WORKING_DIRECTORY || '.';
             if (!path.isAbsolute(workingDirectory)) {
@@ -409,25 +232,50 @@ jobs:
             const runScriptCommand = process.env.RUN_SCRIPT_COMMAND;
             const registryUrl = process.env.REGISTRY_URL;
 
+            // Simple glob matching function
+            function matchGlob(pattern, filename) {
+              const regexPattern = pattern
+                .replace(/\./g, '\\.')
+                .replace(/\*/g, '.*')
+                .replace(/\?/g, '.');
+              return new RegExp(`^${regexPattern}$`).test(filename);
+            }
+
             // Determine what to publish
             let publishTarget = null;
 
             if (packageTarball) {
               // Publishing a specific tarball file
-              const tarballPattern = path.isAbsolute(packageTarball) 
-                ? packageTarball 
-                : path.join(workingDirectory, packageTarball);
-              
-              const matches = await glob(tarballPattern, { nodir: true });
-              
+              let searchDir = workingDirectory;
+              let filePattern = packageTarball;
+
+              if (path.isAbsolute(packageTarball)) {
+                searchDir = path.dirname(packageTarball);
+                filePattern = path.basename(packageTarball);
+              } else if (packageTarball.includes('/')) {
+                searchDir = path.join(workingDirectory, path.dirname(packageTarball));
+                filePattern = path.basename(packageTarball);
+              }
+
+              if (!fs.existsSync(searchDir)) {
+                return core.setFailed(`Search directory does not exist: ${searchDir}`);
+              }
+
+              // Find matching files
+              const allFiles = fs.readdirSync(searchDir);
+              const matches = allFiles
+                .filter(file => matchGlob(filePattern, file))
+                .map(file => path.join(searchDir, file))
+                .filter(file => fs.statSync(file).isFile());
+
               if (matches.length === 0) {
-                return core.setFailed(`No tarball found matching pattern: ${packageTarball}`);
+                return core.setFailed(`No tarball found matching pattern: ${packageTarball} in ${searchDir}`);
               }
-              
+
               if (matches.length > 1) {
                 core.warning(`Multiple tarballs found: ${matches.join(', ')}. Using first match.`);
               }
-              
+
               publishTarget = matches[0];
               core.info(`Publishing tarball: ${publishTarget}`);
             }