chore: tweak npm publish & handle nightly releases (#11513)

* Install node 24, working dir

* Test with prev run id

* Fix artifact and publish path

* Debug

* chore: add missing prepublish

* chore: default to provenance=true unless specified

* chore: meta name

* chore: cleanup

* chore: uncomment workflow_run

---------

Co-authored-by: grandizzy <[email protected]>

Author: o-az

.github/workflows/npm.yml

@@ -2,12 +2,14 @@ name: Publish NPM
 
 on:
   workflow_dispatch:
-  #
-  # Temporarily disabled 
-  #
-  # workflow_run:
-  #   types: [completed]
-  #   workflows: [release]
+    inputs:
+      run_id:
+        type: string
+        required: false
+        description: The run id of the release to publish
+  workflow_run:
+    types: [completed]
+    workflows: [release]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -33,8 +35,6 @@ jobs:
       max-parallel: 3
       fail-fast: false
       matrix:
-        # we don't need a specific runner for any of these
-        # because they've all been built already. We're just publishing
         include:
           - os: linux
             arch: amd64
@@ -46,22 +46,24 @@ jobs:
             arch: arm64
           - os: win32
             arch: amd64
-    # if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    if: ${{ github.event_name == 'workflow_run' && github.event.workflow.conclusion == 'success' }}
     outputs:
       RELEASE_VERSION: ${{ steps.release-version.outputs.RELEASE_VERSION }}
     env:
       NPM_REGISTRY_URL: "https://registry.npmjs.org"
     steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
       - name: Download Release Assets
         uses: actions/download-artifact@v5
         with:
           merge-multiple: true
           # Download all foundry artifacts from the triggering release run
           pattern: "foundry_*"
-          repository: foundry-rs/foundry
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          # run-id: ${{ github.event.workflow_run.id }}
           path: foundry_artifacts
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id || inputs.run_id }}
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@main
@@ -73,66 +75,123 @@ jobs:
       - name: Setup Node (for npm publish auth)
         uses: actions/setup-node@v4
         with:
-          node-version: lts
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
 
       - name: Install Dependencies
-        working-directory: npm
+        working-directory: ./npm
         run: bun install --frozen-lockfile
 
+      - name: Transpile TS -> JS
+        working-directory: ./npm
+        run: bun run build
+
       - name: Derive RELEASE_VERSION
         id: release-version
+        working-directory: ./npm
+        env:
+          PROVENANCE: true
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_REGISTRY_URL: ${{ env.NPM_REGISTRY_URL }}
         run: |
           set -euo pipefail
 
+          echo "Artifacts in foundry_artifacts:"
+          ls -la ../foundry_artifacts || true
+
           # Derive RELEASE_VERSION from any foundry artifact we downloaded
           # Expected names: foundry_<VERSION>_<platform>_<arch>.{tar.gz,zip}
-
           first_file=$(ls ../foundry_artifacts/foundry_* 2>/dev/null | head -n1 || true)
           if [[ -z "${first_file}" ]]; then
             echo "No foundry artifacts found to publish" >&2
             exit 1
           fi
-
           version_part=$(basename "$first_file")
           version_part=${version_part#foundry_}
-
           export RELEASE_VERSION=${version_part%%_*}
-
           echo "Detected RELEASE_VERSION=$RELEASE_VERSION"
+
           echo "RELEASE_VERSION=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"
 
-      - name: Publish Binaries
-        working-directory: npm
+      - name: Stage Binary Into Package
+        working-directory: ./npm
+        env:
+          RELEASE_VERSION: ${{ steps.release-version.outputs.RELEASE_VERSION }}
+        run: |
+          set -euo pipefail
+          mkdir -p tmp
+
+          FILE_PREFIX="../foundry_artifacts/foundry_${RELEASE_VERSION}_${{ matrix.os }}_${{ matrix.arch }}"
+          if [[ -f "${FILE_PREFIX}.zip" ]]; then
+            echo "Extracting ${FILE_PREFIX}.zip"
+            if ! command -v unzip >/dev/null 2>&1; then
+              sudo apt-get update -y && sudo apt-get install -y unzip
+            fi
+            unzip -o "${FILE_PREFIX}.zip" -d ./tmp
+            BIN=./tmp/forge.exe
+          else
+            echo "Extracting ${FILE_PREFIX}.tar.gz"
+            tar -xzf "${FILE_PREFIX}.tar.gz" -C ./tmp
+            BIN=./tmp/forge
+          fi
+
+          echo "Staging binary $BIN into @foundry-rs/forge-${{ matrix.os }}-${{ matrix.arch }}"
+          PLATFORM_NAME=${{ matrix.os }} ARCH=${{ matrix.arch }} FORGE_BIN_PATH="$BIN" bun ./scripts/prepublish.ts
+
+      - name: Sanity Check Binary
+        working-directory: ./npm
+        run: |
+          set -euo pipefail
+          PKG_DIR="./@foundry-rs/forge-${{ matrix.os }}-${{ matrix.arch }}"
+          BIN="$PKG_DIR/bin/forge"
+          if [[ "${{ matrix.os }}" == "win32" ]]; then
+            BIN="$PKG_DIR/bin/forge.exe"
+          fi
+          echo "Verifying binary at: $BIN"
+          ls -la "$BIN"
+          if [[ ! -f "$BIN" ]]; then
+            echo "ERROR: Binary not found at $BIN" >&2
+            exit 1
+          fi
+
+          if [[ "${{ matrix.os }}" != "win32" ]]; then
+            if [[ ! -x "$BIN" ]]; then
+              echo "ERROR: Binary not marked executable" >&2
+              exit 1
+            fi
+          fi
+
+      - name: Publish ${{ matrix.os }}-${{ matrix.arch }} Binary
+        working-directory: ./npm
         env:
           PROVENANCE: true
+          VERSION_NAME: ${{ steps.release-version.outputs.RELEASE_VERSION }}
+          RELEASE_VERSION: ${{ steps.release-version.outputs.RELEASE_VERSION }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_REGISTRY_URL: ${{ env.NPM_REGISTRY_URL }}
         run: |
           set -euo pipefail
 
-          echo "Artifacts in foundry_artifacts:"
-          ls -la ../foundry_artifacts || true
+          ls -la ./@foundry-rs/forge-${{ matrix.os }}-${{ matrix.arch }}
 
-          # Derive RELEASE_VERSION from any foundry artifact we downloaded
-          # Expected names: foundry_<VERSION>_<platform>_<arch>.{tar.gz,zip}
-          first_file=$(ls ../foundry_artifacts/foundry_* 2>/dev/null | head -n1 || true)
-          if [[ -z "${first_file}" ]]; then
-            echo "No foundry artifacts found to publish" >&2
-            exit 1
-          fi
-          version_part=$(basename "$first_file")
-          version_part=${version_part#foundry_}
-          export RELEASE_VERSION=${version_part%%_*}
-          echo "Detected RELEASE_VERSION=$RELEASE_VERSION"
+          bun ./scripts/publish.ts ./@foundry-rs/forge-${{ matrix.os }}-${{ matrix.arch }}
+
+          echo "Published @foundry-rs/forge-${{ matrix.os }}-${{ matrix.arch }}"
 
   publish-meta:
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
     needs: publish-arch
+    name: Publish Meta Package
     runs-on: ubuntu-latest
-    # if: ${{ github.event.workflow_run.conclusion == 'success' }}
     env:
       RELEASE_VERSION: ${{ needs.publish-arch.outputs.RELEASE_VERSION }}
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      NPM_REGISTRY_URL: "https://registry.npmjs.org"
     steps:
       - name: Checkout
         uses: actions/checkout@v5
@@ -147,21 +206,24 @@ jobs:
       - name: Setup Node (for npm publish auth)
         uses: actions/setup-node@v4
         with:
-          node-version: lts
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
 
       - name: Install Dependencies
-        working-directory: npm
+        working-directory: ./npm
         run: bun install --frozen-lockfile
 
-      - name: Publish @foundry-rs/foundry
-        working-directory: npm
+      - name: Transpile TS -> JS
+        working-directory: ./npm
+        run: bun run build
+
+      - name: Publish Meta
+        working-directory: ./npm
+        run: bun run ./scripts/publish.ts ./@foundry-rs/forge
         env:
           PROVENANCE: true
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          bun ./scripts/publish.ts ./@foundry-rs/foundry
-          echo "Published @foundry-rs/foundry"
+          VERSION_NAME: ${{ env.RELEASE_VERSION }}
+          RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+          NPM_TOKEN: ${{ env.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ env.NODE_AUTH_TOKEN }}
+          NPM_REGISTRY_URL: ${{ env.NPM_REGISTRY_URL }}

npm/@foundry-rs/forge-darwin-amd64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foundry-rs/forge-darwin-amd64",
-  "version": "1.2.3",
+  "version": "1.3.2",
   "type": "module",
   "homepage": "https://getfoundry.sh/forge",
   "description": "Fast and flexible Ethereum testing framework (macOS amd64)",

npm/@foundry-rs/forge-linux-amd64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foundry-rs/forge-linux-amd64",
-  "version": "1.2.3",
+  "version": "1.3.2",
   "type": "module",
   "homepage": "https://getfoundry.sh/forge",
   "description": "Fast and flexible Ethereum testing framework (Linux amd64)",

npm/@foundry-rs/forge-linux-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foundry-rs/forge-linux-arm64",
-  "version": "1.2.3",
+  "version": "1.3.2",
   "type": "module",
   "homepage": "https://getfoundry.sh/forge",
   "description": "Fast and flexible Ethereum testing framework (Linux arm64)",

npm/@foundry-rs/forge-win32-amd64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foundry-rs/forge-win32-amd64",
-  "version": "1.2.3",
+  "version": "1.3.2",
   "type": "module",
   "homepage": "https://getfoundry.sh/forge",
   "description": "Fast and flexible Ethereum testing framework (Windows amd64)",

npm/scripts/prepublish.ts

@@ -23,8 +23,6 @@ const TARGET_MAP = {
   'amd64-win32': 'x86_64-pc-windows-msvc'
 } as const
 
-const ARCH_MAP = { amd64: 'x64', arm64: 'arm64', aarch64: 'arm64' } as const
-
 main().catch(error => {
   console.error(colors.red, error)
   process.exit(1)
@@ -43,17 +41,18 @@ async function main() {
 }
 
 function getPlatformInfo() {
-  const platform = Bun.env.PLATFORM_NAME as keyof typeof PLATFORM_MAP
-  const arch = Bun.env.ARCH as keyof typeof ARCH_MAP
+  const platformEnv = Bun.env.PLATFORM_NAME as keyof typeof PLATFORM_MAP
+  const archEnv = (Bun.env.ARCH || '') as 'amd64' | 'arm64' | 'aarch64'
 
-  if (!platform || !arch)
+  if (!platformEnv || !archEnv)
     throw new Error('PLATFORM_NAME and ARCH environment variables are required')
 
-  const npmPlatform = PLATFORM_MAP[platform]
-  const npmArch = ARCH_MAP[arch]
+  const platform = PLATFORM_MAP[platformEnv]
+  // Normalize arch for package names and target mapping
+  const arch = archEnv === 'aarch64' ? 'arm64' : archEnv
 
-  if (!npmPlatform || !npmArch)
-    throw new Error('Invalid platform or architecture')
+  if (!platform || (arch !== 'amd64' && arch !== 'arm64'))
+    throw new Error(`Invalid platform or architecture: platform=${platformEnv}, arch=${archEnv}`)
 
   const { values } = NodeUtil.parseArgs({
     args: Bun.argv,
@@ -67,10 +66,10 @@ function getPlatformInfo() {
   const profile = Bun.env.NODE_ENV === 'production' ? 'release' : Bun.env.PROFILE || 'release'
   const forgeBinPath = values['forge-bin-path'] || findForgeBinary(arch, platform, profile)
 
-  return { platform: npmPlatform, arch: npmArch, forgeBinPath }
+  return { platform, arch, forgeBinPath }
 }
 
-function findForgeBinary(arch: string, platform: string, profile: string): string {
+function findForgeBinary(arch: string, platform: string, profile: string) {
   const targetDir = TARGET_MAP[`${arch}-${platform}` as keyof typeof TARGET_MAP]
   const targetPath = NodePath.join(process.cwd(), '..', 'target', targetDir, profile, 'forge')