From cedfbc08e074285a34143e3deba2f07cda47c604 Mon Sep 17 00:00:00 2001
From: Josh Hunt <joshhunt@users.noreply.github.com>
Date: Thu, 11 Sep 2025 10:03:19 +0100
Subject: [PATCH] NPM: Publish canary packages (#110866)

* publish npm canaries

use build artifact instead

log

tweak

* try and fix path

* k fix correct path to packages

* improve error handling in npm script

* install specific npm version

* restore rest of release workflow

* fix bits

* fix newline that didn't newline

* remove unused exit_if_fail
---
 .github/workflows/release-build.yml | 45 ++++++++++++++++++++++++++++-
 scripts/publish-npm-packages.sh     | 27 ++++++++++++-----
 2 files changed, 63 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml
index 2e4e1ba2b64..f03315fd456 100644
--- a/.github/workflows/release-build.yml
+++ b/.github/workflows/release-build.yml
@@ -140,7 +140,7 @@ jobs:
         # The downside to this is that the frontend will be built for each one when it could be reused for all of them.
         # This could be a future improvement.
         include:
-          - name: linux-amd64
+          - name: linux-amd64 # publish-npm relies on this step building npm packages
             artifacts: targz:grafana:linux/amd64,deb:grafana:linux/amd64,rpm:grafana:linux/amd64,docker:grafana:linux/amd64,docker:grafana:linux/amd64:ubuntu,npm:grafana,storybook
             verify: true
           - name: linux-arm64
@@ -197,6 +197,7 @@ jobs:
           name: artifacts-${{ matrix.name }}
           path: ${{ steps.build.outputs.dist-dir }}
           retention-days: 1
+
   publish-artifacts:
     name: Upload artifacts
     uses: grafana/grafana/.github/workflows/publish-artifact.yml@main
@@ -211,6 +212,7 @@ jobs:
       run-id: ${{ github.run_id }}
       bucket-path: ${{ needs.setup.outputs.version }}_${{ github.run_id }}
       environment: prod
+
   publish-dockerhub:
     if: github.ref_name == 'main'
     permissions:
@@ -268,3 +270,44 @@ jobs:
           docker manifest push grafana/grafana:main-ubuntu
           docker manifest push "grafana/grafana-dev:${VERSION}"
           docker manifest push "grafana/grafana-dev:${VERSION}-ubuntu"
+
+  publish-npm:
+    if: github.ref_name == 'main'
+    permissions:
+      contents: read
+      id-token: write
+    # NPM Trusted Publishing does not yet support self-hosted runners
+    runs-on: github-hosted-ubuntu-x64-small
+    needs:
+      - setup
+      - build
+    env:
+      PACKAGES_VERSION: ${{ needs.setup.outputs.version }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      # Setting nodejs up just for npm publish. Not restoring the cache for all our dependencies
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+
+      # Trusted Publishing is only available in npm v11.5.1 and later
+      - name: Update npm
+        run: npm install -g npm@^11.5.1
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: artifacts-linux-amd64
+          path: dist
+
+      - name: Copy packages
+        run: mv dist/"${PACKAGES_VERSION}"/npm-packages npm-artifacts
+
+      - name: Publish to NPM
+        env:
+          NPM_TOKEN: "oidc"
+        run: ./scripts/publish-npm-packages.sh --dist-tag 'canary' --registry 'https://registry.npmjs.org/'
diff --git a/scripts/publish-npm-packages.sh b/scripts/publish-npm-packages.sh
index 98a799edefa..80a3aed32cd 100755
--- a/scripts/publish-npm-packages.sh
+++ b/scripts/publish-npm-packages.sh
@@ -5,9 +5,6 @@
 dist_tag="canary"
 registry="http://localhost:4873"
 
-# shellcheck source=./scripts/helpers/exit-if-fail.sh
-source "$(dirname "$0")/helpers/exit-if-fail.sh"
-
 if [ -z "$NPM_TOKEN" ]; then
   echo "The NPM_TOKEN environment variable does not exist."
   exit 1
@@ -34,17 +31,31 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
-echo "Starting to release $dist_tag version"
+echo "Starting to release $dist_tag version with NPM version $(npm --version) to registry $registry"
 
-registry_without_protocol=${registry#*:}
-
-echo "$registry_without_protocol/:_authToken=${NPM_TOKEN}" >> ~/.npmrc
+if [[ "$NPM_TOKEN" != "oidc" ]]; then
+  registry_without_protocol=${registry#*:}
+  echo "$registry_without_protocol/:_authToken=${NPM_TOKEN}" >> ~/.npmrc
+fi
 
 # Loop over .tar files in directory and publish them to npm registry
+failed_packages=()
 for file in ./npm-artifacts/*.tgz; do
-    npm publish "$file" --tag "$dist_tag" --registry "$registry"
+    if ! npm publish "$file" --tag "$dist_tag" --registry "$registry"; then
+        failed_packages+=("$file")
+    fi
 done
 
+# Log failed packages and exit with error if any failed
+if (( ${#failed_packages[@]} > 0 )); then
+    echo ""
+    echo "ERROR: The following packages failed to publish:"
+    for pkg in "${failed_packages[@]}"; do
+        echo "  - $pkg"
+    done
+    exit 1
+fi
+
 # Check if any files in packages/grafana-e2e-selectors were changed. If so, add a 'modified' tag to the package
 CHANGES_COUNT=$(git diff HEAD~1..HEAD --name-only -- packages/grafana-e2e-selectors | awk 'END{print NR}')
 if (( CHANGES_COUNT > 0 )); then