feat(ng-dev/release): create recover-ci-publish CLI command

github-actions/release/publish/BUILD.bazel

@@ -1,7 +1,10 @@
 load("@devinfra_npm//:defs.bzl", "npm_link_all_packages")
 load("//tools:defaults.bzl", "esbuild_checked_in", "jasmine_test", "ts_project")
 
-package(default_visibility = ["//github-actions/release/publish:__subpackages__"])
+package(default_visibility = [
+    "//github-actions/release/publish:__subpackages__",
+    "//ng-dev/release:__subpackages__",
+])
 
 npm_link_all_packages()
 

ng-dev/release/BUILD.bazel

@@ -16,6 +16,7 @@ ts_project(
         "//ng-dev/release/npm-dist-tag",
         "//ng-dev/release/precheck",
         "//ng-dev/release/publish",
+        "//ng-dev/release/recover-ci-publish",
         "//ng-dev/release/snapshot-publish",
         "//ng-dev/release/stamping",
         "//ng-dev/utils",

ng-dev/release/cli.ts

@@ -15,6 +15,7 @@ import {ReleasePublishCommandModule} from './publish/cli.js';
 import {ReleasePublishSnapshotsCommandModule} from './snapshot-publish/cli.js';
 import {BuildEnvStampCommand} from './stamping/cli.js';
 import {ReleaseNpmDistTagCommand} from './npm-dist-tag/cli.js';
+import {ReleaseRecoverCiPublishCommandModule} from './recover-ci-publish/cli.js';
 
 /** Build the parser for the release commands. */
 export function buildReleaseParser(localYargs: Argv) {
@@ -29,5 +30,6 @@ export function buildReleaseParser(localYargs: Argv) {
     .command(ReleasePrecheckCommandModule)
     .command(BuildEnvStampCommand)
     .command(ReleaseNotesCommandModule)
-    .command(ReleasePublishSnapshotsCommandModule);
+    .command(ReleasePublishSnapshotsCommandModule)
+    .command(ReleaseRecoverCiPublishCommandModule);
 }

ng-dev/release/recover-ci-publish/BUILD.bazel

@@ -0,0 +1,41 @@
+load("//tools:defaults.bzl", "jasmine_test", "ts_project")
+
+ts_project(
+    name = "recover-ci-publish",
+    srcs = [
+        "cli.ts",
+        "recover-ci-publish.ts",
+    ],
+    visibility = ["//ng-dev:__subpackages__"],
+    deps = [
+        "//github-actions/release/publish:lib",
+        "//ng-dev:node_modules/@types/node",
+        "//ng-dev:node_modules/@types/yargs",
+        "//ng-dev:node_modules/yargs",
+        "//ng-dev/release/config",
+        "//ng-dev/release/versioning",
+        "//ng-dev/utils",
+    ],
+)
+
+ts_project(
+    name = "test_lib",
+    testonly = True,
+    srcs = ["test/recover-ci-publish.spec.ts"],
+    tsconfig = "//ng-dev:tsconfig_test",
+    deps = [
+        ":recover-ci-publish",
+        "//github-actions/release/publish:lib",
+        "//ng-dev:node_modules/@types/jasmine",
+        "//ng-dev:node_modules/@types/node",
+        "//ng-dev/release/versioning",
+        "//ng-dev/utils",
+    ],
+)
+
+jasmine_test(
+    name = "test",
+    data = [
+        ":test_lib",
+    ],
+)

ng-dev/release/recover-ci-publish/cli.ts

@@ -0,0 +1,68 @@
+/**
+ * @license
+ * Copyright Google LLC
+ *
+ * Use of this source code is governed by an MIT-style license that can be
+ * found in the LICENSE file at https://angular.io/license
+ */
+
+import {Argv, Arguments, CommandModule} from 'yargs';
+
+import {assertValidGithubConfig, getConfig} from '../../utils/config.js';
+import {addGithubTokenOption} from '../../utils/git/github-yargs.js';
+import {assertValidReleaseConfig} from '../config/index.js';
+import {AuthenticatedGitClient} from '../../utils/git/authenticated-git-client.js';
+import {ReleaseRecoverCiPublishTool} from './recover-ci-publish.js';
+
+/** Command line options for recovering a CI publish run. */
+export interface ReleaseRecoverCiPublishOptions {
+  runId: number;
+  dryRun: boolean;
+  publishRegistry: string | undefined;
+}
+
+/** Yargs command builder for configuring the `ng-dev release recover-ci-publish` command. */
+function builder(argv: Argv): Argv<ReleaseRecoverCiPublishOptions> {
+  return addGithubTokenOption(argv)
+    .positional('run-id', {
+      type: 'number',
+      demandOption: true,
+      description: 'The GitHub Actions workflow run ID containing the release packages to recover.',
+    })
+    .option('dry-run', {
+      type: 'boolean',
+      default: false,
+      description: 'Run the recovery process in dry-run mode (skips actual publishing).',
+    })
+    .option('publish-registry', {
+      type: 'string',
+      description: 'NPM registry URL to publish packages to (overrides config).',
+    }) as unknown as Argv<ReleaseRecoverCiPublishOptions>;
+}
+
+/** Yargs command handler for recovering a CI publish run. */
+async function handler(args: Arguments<ReleaseRecoverCiPublishOptions>) {
+  const git = await AuthenticatedGitClient.get();
+  const config = await getConfig();
+  assertValidReleaseConfig(config);
+  assertValidGithubConfig(config);
+
+  const tool = new ReleaseRecoverCiPublishTool(git, config.release, config.github, args.runId, {
+    dryRun: args.dryRun,
+    publishRegistry: args.publishRegistry,
+  });
+
+  await tool.run();
+}
+
+/** CLI command module for recovering a failed GHA publish run locally. */
+export const ReleaseRecoverCiPublishCommandModule: CommandModule<
+  {},
+  ReleaseRecoverCiPublishOptions
+> = {
+  builder,
+  handler,
+  command: 'recover-ci-publish <run-id>',
+  describe:
+    'Recover a failed CI release publish run by downloading built artifacts and publishing them locally.',
+};

ng-dev/release/recover-ci-publish/recover-ci-publish.ts

@@ -0,0 +1,183 @@
+/**
+ * @license
+ * Copyright Google LLC
+ *
+ * Use of this source code is governed by an MIT-style license that can be
+ * found in the LICENSE file at https://angular.io/license
+ */
+
+import fs from 'node:fs';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+
+import {GithubConfig} from '../../utils/config.js';
+import {ReleaseConfig} from '../config/index.js';
+import {AuthenticatedGitClient} from '../../utils/git/authenticated-git-client.js';
+import {ChildProcess} from '../../utils/child-process.js';
+import {NpmCommand} from '../versioning/npm-command.js';
+import {PublishCiTool} from '../../../github-actions/release/publish/lib/publish-ci.js';
+import {Log} from '../../utils/logging.js';
+import {Prompt} from '../../utils/prompt.js';
+
+/** Options for configuring the ReleaseRecoverCiPublishTool. */
+export interface ReleaseRecoverCiPublishToolOptions {
+  /** Whether to run in dry-run mode. */
+  dryRun?: boolean;
+  /** NPM registry URL to publish packages to (overrides config). */
+  publishRegistry?: string;
+}
+
+/**
+ * Tool to recover a failed CI release publish run locally.
+ *
+ * Downloads the built packages (.tgz) from a failed GitHub Actions run,
+ * extracts them, and publishes them locally using the user's Wombat token session.
+ */
+export class ReleaseRecoverCiPublishTool {
+  constructor(
+    private git: AuthenticatedGitClient,
+    private releaseConfig: ReleaseConfig,
+    private githubConfig: GithubConfig,
+    private runId: number,
+    private options: ReleaseRecoverCiPublishToolOptions = {},
+  ) {}
+
+  /** Runs the recovery process. */
+  async run(): Promise<void> {
+    const registry = this.options.publishRegistry ?? this.releaseConfig.publishRegistry;
+
+    // 1. Verify NPM Login State (Fail fast)
+    const loginOk = await this._verifyNpmLoginState(registry);
+    if (!loginOk) {
+      Log.error('  ✘   NPM login verification failed. Aborting recovery.');
+      process.exitCode = 1;
+      return;
+    }
+
+    // Create temp directory for downloading and extracting artifacts
+    const tempDir = fs.mkdtempSync(path.join(tmpdir(), 'ng-dev-publish-recovery-'));
+    Log.debug(`Created temp directory: ${tempDir}`);
+
+    try {
+      // 2. Fetch GHA Run Details
+      Log.info(`Fetching workflow run details for run ID: ${this.runId}...`);
+      const {data: run} = await this.git.github.rest.actions.getWorkflowRun({
+        owner: this.githubConfig.owner,
+        repo: this.githubConfig.name,
+        run_id: this.runId,
+      });
+      Log.info(`Found run: ${run.name} (Commit SHA: ${run.head_sha})`);
+
+      // 3. Fetch Artifacts List
+      Log.info('Fetching list of artifacts for this run...');
+      const {data: artifactsData} = await this.git.github.rest.actions.listWorkflowRunArtifacts({
+        owner: this.githubConfig.owner,
+        repo: this.githubConfig.name,
+        run_id: this.runId,
+      });
+
+      const artifactName = 'release-packages-tgz';
+      const artifact = artifactsData.artifacts.find((art: any) => art.name === artifactName);
+      if (!artifact) {
+        throw new Error(`Expected artifact "${artifactName}" not found in run ${this.runId}.`);
+      }
+
+      // 4. Download Artifact ZIP
+      Log.info(`Downloading artifact "${artifactName}" (ID: ${artifact.id})...`);
+      const downloadResponse = await this.git.github.rest.actions.downloadArtifact({
+        owner: this.githubConfig.owner,
+        repo: this.githubConfig.name,
+        artifact_id: artifact.id,
+        archive_format: 'zip',
+      });
+
+      // downloadArtifact returns an ArrayBuffer which we convert to a Buffer to write to disk.
+      const buffer = Buffer.from(downloadResponse.data as ArrayBuffer);
+      const zipPath = path.join(tempDir, 'artifacts.zip');
+      fs.writeFileSync(zipPath, buffer);
+      Log.info(`Downloaded artifact zip to ${zipPath}`);
+
+      // 5. Extract Artifact ZIP
+      const extractDir = path.join(tempDir, 'extracted');
+      fs.mkdirSync(extractDir, {recursive: true});
+      Log.info(`Extracting packages to ${extractDir}...`);
+
+      try {
+        // Spawn native unzip utility
+        await ChildProcess.spawn('unzip', [zipPath, '-d', extractDir], {mode: 'silent'});
+      } catch (err: any) {
+        if (err && err.code === 'ENOENT') {
+          throw new Error(
+            `Failed to execute 'unzip'. Please ensure that the 'unzip' utility is installed and available in your PATH.`,
+          );
+        }
+        throw new Error(`Failed to extract packages zip artifact: ${err}`);
+      }
+      Log.info('Packages extracted successfully.');
+
+      // 6. Publish via PublishCiTool
+      Log.info('Initializing PublishCiTool for local publishing...');
+      const tool = new PublishCiTool(
+        {github: this.githubConfig, release: this.releaseConfig} as any,
+        this.git,
+        this.git.baseDir, // Project root directory where local package.json / git is located
+        {
+          builtPackagesDir: extractDir,
+          expectedSha: run.head_sha,
+          useLocalNpmConfig: true, // Bypasses GHA Wombat token check, uses local configuration
+          dryRun: this.options.dryRun,
+          skipTagging: true, // Tagging should be done in GHA, only recover publishing
+        },
+      );
+
+      Log.info('Starting local publishing of recovered packages...');
+      await tool.run();
+      Log.info('Local recovery publishing completed.');
+    } catch (e) {
+      Log.error('  ✘   An error occurred during recovery:');
+      Log.error(e);
+      process.exitCode = 1;
+    } finally {
+      // 7. Cleanup
+      Log.debug(`Cleaning up temp directory: ${tempDir}`);
+      try {
+        fs.rmSync(tempDir, {recursive: true, force: true});
+      } catch (err) {
+        Log.warn(`Warning: Could not remove temp directory ${tempDir}:`, err);
+      }
+    }
+  }
+
+  /** Verifies that the user is logged into NPM locally. */
+  private async _verifyNpmLoginState(registry: string | undefined): Promise<boolean> {
+    const registryName = `NPM at the ${registry ?? 'default NPM'} registry`;
+
+    if (registry?.includes('wombat-dressing-room.appspot.com')) {
+      Log.info('Unable to determine NPM login state for Wombat proxy, requiring login now.');
+      try {
+        await NpmCommand.startInteractiveLogin(registry);
+      } catch {
+        return false;
+      }
+      return true;
+    }
+
+    if (await NpmCommand.checkIsLoggedIn(registry)) {
+      Log.debug(`Already logged into ${registryName}.`);
+      return true;
+    }
+
+    Log.warn(`  ✘   Not currently logged into ${registryName}.`);
+    const shouldLogin = await Prompt.confirm({message: 'Would you like to log into NPM now?'});
+    if (shouldLogin) {
+      try {
+        await NpmCommand.startInteractiveLogin(registry);
+        return true;
+      } catch (e) {
+        Log.error('NPM login failed:', e);
+        return false;
+      }
+    }
+    return false;
+  }
+}