From 43ffe6d85c87333520564735b071b35468486977 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ole=20Andr=C3=A9=20Vadla=20Ravn=C3=A5s?= <oleavr@frida.re>
Date: Tue, 6 Jan 2026 14:38:33 +0100
Subject: [PATCH] ci: Add npm publish workflow with provenance

Publish frida-node from CI with npm provenance enabled so the
registry can validate the source repository during release.

The workflow is triggered when publish-prod starts in the
frida monorepo and builds from the matching version tag.
---
 .github/workflows/publish.yml | 52 +++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..2e9fa15
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,52 @@
+name: Publish to npm
+
+on:
+  repository_dispatch:
+    types: [publish-prod-started]
+
+  workflow_dispatch:
+    inputs:
+      frida_version:
+        description: "version to publish (e.g. 17.0.0)"
+        required: true
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: npm-publish-frida-${{ github.event.client_payload.frida_version || inputs.frida_version || github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Build & publish
+    runs-on: ubuntu-latest
+    env:
+      FRIDA_VERSION: ${{ github.event.client_payload.frida_version || inputs.frida_version }}
+    steps:
+      - name: Validate inputs
+        shell: bash
+        run: |
+          if [[ -z "${FRIDA_VERSION}" ]]; then
+            echo "FRIDA_VERSION is required."
+            exit 1
+          fi
+          echo "FRIDA_VERSION=${FRIDA_VERSION}"
+      - name: Check out repo
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.FRIDA_VERSION }}
+          fetch-depth: 0
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+      - name: Build
+        run: |
+          npm version "${FRIDA_VERSION}" --no-git-tag-version
+          ./configure -- -Dfrida-core:compat=disabled
+          make
+          npm ci
+      - name: Publish to npm with provenance
+        run: npm publish --provenance