From 1ffccfaa9b2ec68b36e972874b53053b79da6ae9 Mon Sep 17 00:00:00 2001
From: Carolina Canelas <carolina.canelas@vtex.com>
Date: Mon, 24 Aug 2026 16:16:52 -0300
Subject: [PATCH] chore: publish npm via DK-CICD instead of NPM_TOKEN

The GitHub Actions NPM_TOKEN secret is expired, so tag publishes fail.
Switch to the same npm-publish-v1 + Trusted Publishing flow used by node-vtex-api.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/ci.yml                     | 37 --------
 .github/workflows/publish-npm.yml            | 95 ++++++++++++++++++++
 .github/workflows/publish-prerelease-npm.yml | 24 -----
 .github/workflows/publish-stable-npm.yml     | 24 -----
 .vtex/deployment.yaml                        | 14 +++
 CHANGELOG.md                                 |  4 +
 6 files changed, 113 insertions(+), 85 deletions(-)
 delete mode 100644 .github/workflows/ci.yml
 create mode 100644 .github/workflows/publish-npm.yml
 delete mode 100644 .github/workflows/publish-prerelease-npm.yml
 delete mode 100644 .github/workflows/publish-stable-npm.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index 2aafa9d..0000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,37 +0,0 @@
-name: ci
-
-on:
-  push:
-    branches:
-      - '**'
-    tags-ignore:
-      - '**'
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v1
-        with:
-          node-version: 12
-      - run: yarn install --ignore-scripts
-      - run: yarn run ci:prettier-check
-      - run: yarn run lint
-
-  test:
-    needs: [lint]
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: true
-      matrix:
-        node-version: [12]
-        os: [ubuntu-latest, windows-latest, macOS-latest]
-
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v1
-        with:
-          node-version: ${{ matrix.node-version }}
-      - run: yarn install --ignore-scripts
-      - run: yarn run ci:test
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
new file mode 100644
index 0000000..4a4840d
--- /dev/null
+++ b/.github/workflows/publish-npm.yml
@@ -0,0 +1,95 @@
+name: Publish from CodeArtifact to npm
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Package Version (ex: 1.2.3)'
+        required: true
+        type: string
+      environment:
+        description: 'Environment (production or beta)'
+        required: true
+        type: choice
+        options:
+          - production
+          - beta
+      CA_TOKEN:
+        description: 'CodeArtifact Token'
+        required: true
+        type: string
+      CA_OWNER:
+        description: 'CodeArtifact Domain Owner'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  id-token: write   # required for Trusted Publishing
+
+env:
+  CODEARTIFACT_DOMAIN: main
+  CODEARTIFACT_REPOSITORY: internal-npm
+  NPM_PACKAGE_NAME: "@vtex/cli-plugin-submit"
+  AWS_REGION: us-east-1
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Configure npm for CodeArtifact
+        run: |
+          set -euo pipefail
+
+          export CODEARTIFACT_TOKEN="${{ github.event.inputs.CA_TOKEN}}"
+          echo "::add-mask::${{ github.event.inputs.CA_TOKEN}}"
+          export CODEARTIFACT_DOMAIN_OWNER="${{ github.event.inputs.CA_OWNER}}"
+          echo "::add-mask::${{ github.event.inputs.CA_OWNER}}"
+
+          if [ -z "${CODEARTIFACT_TOKEN:-}" ]; then
+            echo "CODEARTIFACT_TOKEN not set"; exit 1
+          fi
+
+          CODEARTIFACT_URL="https://${CODEARTIFACT_DOMAIN}-${CODEARTIFACT_DOMAIN_OWNER}.d.codeartifact.${AWS_REGION}.amazonaws.com/npm/${CODEARTIFACT_REPOSITORY}/"
+
+          echo "Configuring npm to use ${CODEARTIFACT_URL}"
+
+          npm config set registry "${CODEARTIFACT_URL}"
+          npm config set "//${CODEARTIFACT_DOMAIN}-${CODEARTIFACT_DOMAIN_OWNER}.d.codeartifact.${AWS_REGION}.amazonaws.com/npm/${CODEARTIFACT_REPOSITORY}/:_authToken" "${CODEARTIFACT_TOKEN}"
+
+      - name: Download package from CodeArtifact
+        run: |
+          set -euo pipefail
+          VERSION="${{ github.event.inputs.version }}"
+
+          echo "Downloading ${NPM_PACKAGE_NAME}@${VERSION} from CodeArtifact..."
+          npm pack "${NPM_PACKAGE_NAME}@${VERSION}"
+
+          echo "Generated files:"
+          ls -1 *.tgz
+
+      - name: Set npm registry to npmjs
+        run: |
+          set -euo pipefail
+          npm config set registry https://registry.npmjs.org
+          npm install -g npm@latest
+
+      - name: Publish tarball to npmjs
+        run: |
+          set -euo pipefail
+
+          TARBALL=$(ls -1 *.tgz | head -n 1)
+          TAG_FLAG=""
+          if [ "${{ github.event.inputs.environment }}" = "beta" ]; then
+            TAG_FLAG="--tag beta"
+          fi
+          echo "Publishing ${TARBALL} to npmjs..."
+          npm publish "${TARBALL}" --provenance --access public ${TAG_FLAG}
diff --git a/.github/workflows/publish-prerelease-npm.yml b/.github/workflows/publish-prerelease-npm.yml
deleted file mode 100644
index aa44a79..0000000
--- a/.github/workflows/publish-prerelease-npm.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-name: publish-prerelease:npm
-
-on:
-  push:
-    branches-ignore:
-      - '**'
-    tags:
-      - 'v[0-9]+.[0-9]+.[0-9]+-beta*'
-
-jobs:
-  npm-publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v1
-        with:
-          node-version: 12
-          registry-url: https://registry.npmjs.org/
-      - run: yarn install --ignore-scripts
-      - run: yarn build
-      - run: npm publish --access=public --tag beta
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-          IS_CI: 'true'
diff --git a/.github/workflows/publish-stable-npm.yml b/.github/workflows/publish-stable-npm.yml
deleted file mode 100644
index 2c94d07..0000000
--- a/.github/workflows/publish-stable-npm.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-name: publish-stable:npm
-
-on:
-  push:
-    branches-ignore:
-      - '**'
-    tags:
-      - 'v[0-9]+.[0-9]+.[0-9]+'
-
-jobs:
-  npm-publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v1
-        with:
-          node-version: 12
-          registry-url: https://registry.npmjs.org/
-      - run: yarn install --ignore-scripts
-      - run: yarn build
-      - run: npm publish --access=public
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-          IS_CI: 'true'
diff --git a/.vtex/deployment.yaml b/.vtex/deployment.yaml
index 2b4954b..4dd990c 100644
--- a/.vtex/deployment.yaml
+++ b/.vtex/deployment.yaml
@@ -30,3 +30,17 @@
           - event: push
             source: branch
             regex: master
+
+      - name: npm-publish-v1
+        parameters:
+          nodeVersion: "20-bookworm"
+          packageManager: yarn
+          skipInstall: false
+          nodeCommands:
+            - build
+          publishViaGithubWorkflow: true
+          workflowFile: publish-npm.yml
+          workflowVersion: '{{ ref_name }}'
+        when:
+          - event: push
+            source: tag
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 05c5b08..9e4ee58 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Publish to npm via DK-CICD `npm-publish-v1` and GitHub Trusted Publishing instead of the `NPM_TOKEN` Actions workflows
+
 ## [1.1.5] - 2026-08-24
 
 ### Fixed