Add browser destination artifact publish workflow

[varadarajan-tw]

Goal

Add a short-term browser destination publishing workflow that runs independently and concurrently with npm package publishing on main and staging.

Review Guide

• publish-browser-destinations.yml listens for pushes to main and staging, then runs only when the pushed commit message starts with Publish. The existing publish.yml is unchanged, so both workflows start independently on the same release push.
• A detector compares the release against the previous Publish commit on first-parent history and watches browser destinations plus their bundled runtime/shared packages. Additions, renames, deletions, multi-commit releases, and shared-runtime changes are covered.
• The first release without a prior artifact, a failed/expired artifact, or an artifact API lookup failure rebuilds instead of permanently skipping.
• main builds production bundles; staging builds stage bundles.
• The build explicitly checks out and verifies github.sha. Artifacts are named browser-destinations-{environment}-{sha}, belong to a workflow run with the same head_sha, fail on empty output, and are retained for 7 days. Consumers should fetch by workflow run ID and verify head_sha.
• The workflow uses read-only permissions and does not receive NPM_TOKEN.
• The stage build and upload were validated end to end in run 31167898593, producing a 32.3 MB artifact.
• The final dedicated workflow is installed on staging at commit 83a2bd4a4; its non-Publish installation run was skipped as intended.

[Copilot]

Pull request overview

Adds a manually-triggered GitHub Actions workflow to build browser destination bundles for a selected environment and upload the built dist/web/ output as an artifact for later download (e.g., by a backend that uploads to S3).

Changes:

• Introduces a new workflow_dispatch workflow with environment and branch inputs.
• Builds the destinations manifest and then builds browser bundles using the existing package scripts.
• Uploads packages/browser-destinations/dist/web/ as a short-lived artifact.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

[varadarajan-tw]

@copilot review

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Suppressed comments (3)

.github/workflows/publish.yml:40

• This diff only compares HEAD^..HEAD, which misses changes when the push contains multiple commits (e.g., browser-destinations changed in an earlier commit but not the final HEAD commit). For push-triggered workflows, diff against the full pushed range (e.g., ${{ github.event.before }}..${{ github.sha }}) so the gate reflects all changes included in the push.

        run: |
          if git diff --quiet HEAD^ HEAD -- packages/browser-destinations/; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

.github/workflows/publish.yml:20

• The comparison to == true is redundant in GitHub Actions expressions. You can simplify to if: startsWith(github.event.head_commit.message, 'Publish') for clarity.

    if: startsWith(github.event.head_commit.message, 'Publish') == true

.github/workflows/publish.yml:48

• ubuntu-latest-large is not a standard GitHub-hosted runner label. If this repository isn’t configured with a self-hosted runner (or a custom runner label) named ubuntu-latest-large, this job will never start. Consider using ubuntu-latest or a verified runner label used elsewhere in the repo.

    runs-on: ubuntu-latest-large

[varadarajan-tw]

@copilot review

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

.github/workflows/publish.yml:46

• git log ... HEAD^ will fail on an orphan branch / first commit (no parent). Since Actions bash steps typically run with -e, this would fail the job (and block downstream jobs). Consider making the parent lookup resilient (e.g., guard for a missing parent and treat it as no previous publish, or make the git log command non-fatal) so publishing doesn’t break in these scenarios.

          previous_publish=''
          while IFS=$'\t' read -r commit subject; do
            if [[ "$subject" == Publish* ]]; then
              previous_publish="$commit"
              break
            fi
          done < <(git log --first-parent --format='%H%x09%s' HEAD^)

[varadarajan-tw]

@copilot review

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

Suppressed comments (4)

.github/workflows/publish-browser-destinations.yml:62

• Artifact lookup only fetches the first 100 artifacts. If the repository produces more than 100 artifacts within the retention window, the target artifact could be on a later page, causing unnecessary rebuilds. Consider using gh api --paginate (and filtering via jq) so the search is correct regardless of artifact volume.

            if artifacts=$(gh api --method GET \
              "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts" \
              -f name="$artifact_name" \
              -f per_page=100) && \
              artifact_count=$(jq --arg name "$artifact_name" \
                '[.artifacts[] | select(.name == $name and .expired == false)] | length' \
                <<< "$artifacts") && \
              [ "$artifact_count" -gt 0 ]; then

.github/workflows/publish-browser-destinations.yml:9

• PR description states main and hotfix/** run build-web, but this workflow only triggers on main and staging. Either update the workflow on.push.branches to include hotfix/** (if intended), or adjust the PR description to match the actual triggers.

  push:
    branches:
      - main
      - staging

.github/workflows/publish-browser-destinations.yml:31

• The environment-to-suffix mapping (staging → stage, else production) is duplicated in two places. To reduce drift risk, consider setting a single job/workflow-level env (or an output from the detect job) and reusing it for both detection and artifact naming.

          ARTIFACT_ENVIRONMENT: ${{ github.ref_name == 'staging' && 'stage' || 'production' }}

.github/workflows/publish-browser-destinations.yml:114

• The environment-to-suffix mapping (staging → stage, else production) is duplicated in two places. To reduce drift risk, consider setting a single job/workflow-level env (or an output from the detect job) and reusing it for both detection and artifact naming.

          name: browser-destinations-${{ github.ref_name == 'staging' && 'stage' || 'production' }}-${{ github.sha }}

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Suppressed comments (3)

.github/workflows/publish-browser-destinations.yml:13

• The == true comparison is redundant in GitHub Actions expressions and makes the condition noisier. Prefer if: startsWith(github.event.head_commit.message, 'Publish') for clarity.

    if: startsWith(github.event.head_commit.message, 'Publish') == true

.github/workflows/publish-browser-destinations.yml:62

• The actions/artifacts REST endpoint doesn’t support filtering by name via query string, so -f name=... is misleading and may be ignored by the API. Since you already filter by name in jq, remove the unsupported query param (or add a brief comment explaining it’s intentionally client-side filtered) to avoid future confusion.

            if artifacts=$(gh api --method GET \
              "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts" \
              -f name="$artifact_name" \
              -f per_page=100) && \
              artifact_count=$(jq --arg name "$artifact_name" \
                '[.artifacts[] | select(.name == $name and .expired == false)] | length' \
                <<< "$artifacts") && \
              [ "$artifact_count" -gt 0 ]; then

.github/workflows/publish-browser-destinations.yml:62

• This only requests the first page (per_page=100) of artifacts. If the repo accumulates more than 100 artifacts, an older (but still non-expired) matching artifact might not be returned, causing unnecessary rebuilds. Consider using gh api --paginate and aggregating results (or stop early once a match is found) so the skip logic remains correct as artifact count grows.

            if artifacts=$(gh api --method GET \
              "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts" \
              -f name="$artifact_name" \
              -f per_page=100) && \
              artifact_count=$(jq --arg name "$artifact_name" \
                '[.artifacts[] | select(.name == $name and .expired == false)] | length' \
                <<< "$artifacts") && \
              [ "$artifact_count" -gt 0 ]; then