From 194552967addf724ea3e63736adee9e6819eebb1 Mon Sep 17 00:00:00 2001
From: Varadarajan V <109586712+varadarajan-tw@users.noreply.github.com>
Date: Tue, 12 May 2026 20:17:45 +0530
Subject: [PATCH 01/14] Add on-demand workflow to build and upload browser
 destination bundles

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../workflows/build-browser-destinations.yml  | 52 +++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 .github/workflows/build-browser-destinations.yml

diff --git a/.github/workflows/build-browser-destinations.yml b/.github/workflows/build-browser-destinations.yml
new file mode 100644
index 00000000000..cb148757d2c
--- /dev/null
+++ b/.github/workflows/build-browser-destinations.yml
@@ -0,0 +1,52 @@
+name: Build Browser Destinations
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Target environment
+        required: true
+        type: choice
+        options:
+          - stage
+          - production
+      branch:
+        description: Branch to build from
+        required: true
+        type: string
+        default: main
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          ref: ${{ inputs.branch }}
+
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+          cache: yarn
+
+      - name: Install Dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Build Destinations Manifest
+        run: nx build @segment/destinations-manifest
+
+      - name: Build Browser Bundles
+        working-directory: packages/browser-destinations
+        run: ${{ inputs.environment == 'production' && 'yarn build-web' || 'yarn build-web-stage' }}
+
+      - name: Upload Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: browser-destinations-${{ inputs.environment }}-${{ github.sha }}
+          path: packages/browser-destinations/dist/web/
+          retention-days: 7

From 2a3bdf2fe2a7478c64b875857904acf859178778 Mon Sep 17 00:00:00 2001
From: Varadarajan V <109586712+varadarajan-tw@users.noreply.github.com>
Date: Tue, 12 May 2026 20:24:12 +0530
Subject: [PATCH 02/14] Fix security and correctness issues in browser
 destinations workflow

- Use git rev-parse HEAD for artifact SHA instead of github.sha (was wrong for non-main branches)
- Add job-level environment to enforce GitHub Environment protection rules
- Add concurrency group to prevent simultaneous builds for the same environment
- Add permissions: contents: read for least-privilege token
- Add NPM_TOKEN and registry-url for authenticated yarn install
- Use yarn nx instead of bare nx to avoid fragile transitive resolution
- Set if-no-files-found: error on artifact upload to catch empty dist
- Increase retention-days to 30 for production deploy artifacts
- Reduce timeout to 20 minutes to match existing browser bundle CI job

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../workflows/build-browser-destinations.yml  | 24 +++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-browser-destinations.yml b/.github/workflows/build-browser-destinations.yml
index cb148757d2c..27604dcaedd 100644
--- a/.github/workflows/build-browser-destinations.yml
+++ b/.github/workflows/build-browser-destinations.yml
@@ -16,29 +16,44 @@ on:
         type: string
         default: main
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
     runs-on: ubuntu-22.04
-    timeout-minutes: 30
+    timeout-minutes: 20
+    environment: ${{ inputs.environment }}
+    concurrency:
+      group: build-browser-destinations-${{ inputs.environment }}
+      cancel-in-progress: false
 
     steps:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
+          fetch-depth: 1
           ref: ${{ inputs.branch }}
 
+      - name: Get checkout SHA
+        id: sha
+        run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+
       - name: Use Node.js 22.x
         uses: actions/setup-node@v4
         with:
           node-version: 22.x
+          registry-url: 'https://registry.npmjs.org'
           cache: yarn
 
       - name: Install Dependencies
         run: yarn install --frozen-lockfile
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Build Destinations Manifest
-        run: nx build @segment/destinations-manifest
+        run: yarn nx build @segment/destinations-manifest
 
       - name: Build Browser Bundles
         working-directory: packages/browser-destinations
@@ -47,6 +62,7 @@ jobs:
       - name: Upload Artifact
         uses: actions/upload-artifact@v4
         with:
-          name: browser-destinations-${{ inputs.environment }}-${{ github.sha }}
+          name: browser-destinations-${{ inputs.environment }}-${{ steps.sha.outputs.sha }}
           path: packages/browser-destinations/dist/web/
-          retention-days: 7
+          if-no-files-found: error
+          retention-days: 30

From 723aebea26fd042bd615a85acd6fe4d1592d709c Mon Sep 17 00:00:00 2001
From: Varadarajan V <109586712+varadarajan-tw@users.noreply.github.com>
Date: Tue, 12 May 2026 20:29:43 +0530
Subject: [PATCH 03/14] =?UTF-8?q?Remove=20job-level=20environment=20gate?=
 =?UTF-8?q?=20=E2=80=94=20deployment=20approval=20belongs=20in=20the=20bac?=
 =?UTF-8?q?kend=20service?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/build-browser-destinations.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/build-browser-destinations.yml b/.github/workflows/build-browser-destinations.yml
index 27604dcaedd..053dd8bed50 100644
--- a/.github/workflows/build-browser-destinations.yml
+++ b/.github/workflows/build-browser-destinations.yml
@@ -24,7 +24,6 @@ jobs:
     name: Build
     runs-on: ubuntu-22.04
     timeout-minutes: 20
-    environment: ${{ inputs.environment }}
     concurrency:
       group: build-browser-destinations-${{ inputs.environment }}
       cancel-in-progress: false

From 752f67f5dd3c339c620aa3aaa3bc04da53070379 Mon Sep 17 00:00:00 2001
From: Arijit Ray <35370469+itsarijitray@users.noreply.github.com>
Date: Wed, 1 Jul 2026 15:50:48 +0530
Subject: [PATCH 04/14] chore: address Copilot review comments on browser build
 workflow

- Use github.event.inputs.* to match other workflow_dispatch workflows
- Set retention-days to 7 to match PR description

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build-browser-destinations.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build-browser-destinations.yml b/.github/workflows/build-browser-destinations.yml
index 053dd8bed50..0b193ad0a31 100644
--- a/.github/workflows/build-browser-destinations.yml
+++ b/.github/workflows/build-browser-destinations.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     concurrency:
-      group: build-browser-destinations-${{ inputs.environment }}
+      group: build-browser-destinations-${{ github.event.inputs.environment }}
       cancel-in-progress: false
 
     steps:
@@ -33,7 +33,7 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 1
-          ref: ${{ inputs.branch }}
+          ref: ${{ github.event.inputs.branch }}
 
       - name: Get checkout SHA
         id: sha
@@ -56,12 +56,12 @@ jobs:
 
       - name: Build Browser Bundles
         working-directory: packages/browser-destinations
-        run: ${{ inputs.environment == 'production' && 'yarn build-web' || 'yarn build-web-stage' }}
+        run: ${{ github.event.inputs.environment == 'production' && 'yarn build-web' || 'yarn build-web-stage' }}
 
       - name: Upload Artifact
         uses: actions/upload-artifact@v4
         with:
-          name: browser-destinations-${{ inputs.environment }}-${{ steps.sha.outputs.sha }}
+          name: browser-destinations-${{ github.event.inputs.environment }}-${{ steps.sha.outputs.sha }}
           path: packages/browser-destinations/dist/web/
           if-no-files-found: error
-          retention-days: 30
+          retention-days: 7

From 4091af9cbbec8d919838137bcdaa13b890952584 Mon Sep 17 00:00:00 2001
From: Arijit Ray <35370469+itsarijitray@users.noreply.github.com>
Date: Wed, 1 Jul 2026 15:54:05 +0530
Subject: [PATCH 05/14] Apply suggestions from code review

Co-authored-by: semgrep-code-segmentio-2[bot] <240576539+semgrep-code-segmentio-2[bot]@users.noreply.github.com>
---
 .github/workflows/build-browser-destinations.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-browser-destinations.yml b/.github/workflows/build-browser-destinations.yml
index 0b193ad0a31..36850a7c065 100644
--- a/.github/workflows/build-browser-destinations.yml
+++ b/.github/workflows/build-browser-destinations.yml
@@ -29,7 +29,7 @@ jobs:
       cancel-in-progress: false
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -40,7 +40,7 @@ jobs:
         run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
       - name: Use Node.js 22.x
-        uses: actions/setup-node@v4
+      uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22.x
           registry-url: 'https://registry.npmjs.org'
@@ -59,7 +59,7 @@ jobs:
         run: ${{ github.event.inputs.environment == 'production' && 'yarn build-web' || 'yarn build-web-stage' }}
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.6.0
         with:
           name: browser-destinations-${{ github.event.inputs.environment }}-${{ steps.sha.outputs.sha }}
           path: packages/browser-destinations/dist/web/

From 7c457417d2c81a76d178455e825038e05ac56619 Mon Sep 17 00:00:00 2001
From: Arijit Ray <35370469+itsarijitray@users.noreply.github.com>
Date: Wed, 1 Jul 2026 16:00:29 +0530
Subject: [PATCH 06/14] fix: correct indentation of setup-node uses key in
 browser build workflow

The uses: key on the Use Node.js step was indented 6 spaces instead of
8, producing "Invalid workflow file" YAML syntax errors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build-browser-destinations.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-browser-destinations.yml b/.github/workflows/build-browser-destinations.yml
index 36850a7c065..93364e196e3 100644
--- a/.github/workflows/build-browser-destinations.yml
+++ b/.github/workflows/build-browser-destinations.yml
@@ -40,7 +40,7 @@ jobs:
         run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
       - name: Use Node.js 22.x
-      uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22.x
           registry-url: 'https://registry.npmjs.org'

From 7448278a6a00ba043569e73cff84a6cba622b347 Mon Sep 17 00:00:00 2001
From: Arijit Ray <35370469+itsarijitray@users.noreply.github.com>
Date: Wed, 1 Jul 2026 16:15:23 +0530
Subject: [PATCH 07/14] chore: align browser build workflow runner and action
 pins with repo convention

- Use ubuntu-latest-large runner label like all other workflows
- Pin setup-node to the same SHA (v4) used across ci.yml and others

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build-browser-destinations.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-browser-destinations.yml b/.github/workflows/build-browser-destinations.yml
index 93364e196e3..17cc86c0153 100644
--- a/.github/workflows/build-browser-destinations.yml
+++ b/.github/workflows/build-browser-destinations.yml
@@ -22,7 +22,7 @@ permissions:
 jobs:
   build:
     name: Build
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest-large
     timeout-minutes: 20
     concurrency:
       group: build-browser-destinations-${{ github.event.inputs.environment }}
@@ -40,7 +40,7 @@ jobs:
         run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
       - name: Use Node.js 22.x
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22.x
           registry-url: 'https://registry.npmjs.org'

From 0dd8f15b3660087bec1aa9fe3b52b99ed72354d5 Mon Sep 17 00:00:00 2001
From: Varadarajan V <vvijayaragavan@twilio.com>
Date: Fri, 7 Aug 2026 14:35:31 +0530
Subject: [PATCH 08/14] chore: build browser artifacts during publish

---
 .../workflows/build-browser-destinations.yml  | 67 -------------------
 .github/workflows/publish.yml                 | 45 +++++++++++++
 2 files changed, 45 insertions(+), 67 deletions(-)
 delete mode 100644 .github/workflows/build-browser-destinations.yml

diff --git a/.github/workflows/build-browser-destinations.yml b/.github/workflows/build-browser-destinations.yml
deleted file mode 100644
index 17cc86c0153..00000000000
--- a/.github/workflows/build-browser-destinations.yml
+++ /dev/null
@@ -1,67 +0,0 @@
-name: Build Browser Destinations
-
-on:
-  workflow_dispatch:
-    inputs:
-      environment:
-        description: Target environment
-        required: true
-        type: choice
-        options:
-          - stage
-          - production
-      branch:
-        description: Branch to build from
-        required: true
-        type: string
-        default: main
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Build
-    runs-on: ubuntu-latest-large
-    timeout-minutes: 20
-    concurrency:
-      group: build-browser-destinations-${{ github.event.inputs.environment }}
-      cancel-in-progress: false
-
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-          fetch-depth: 1
-          ref: ${{ github.event.inputs.branch }}
-
-      - name: Get checkout SHA
-        id: sha
-        run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-
-      - name: Use Node.js 22.x
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22.x
-          registry-url: 'https://registry.npmjs.org'
-          cache: yarn
-
-      - name: Install Dependencies
-        run: yarn install --frozen-lockfile
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Build Destinations Manifest
-        run: yarn nx build @segment/destinations-manifest
-
-      - name: Build Browser Bundles
-        working-directory: packages/browser-destinations
-        run: ${{ github.event.inputs.environment == 'production' && 'yarn build-web' || 'yarn build-web-stage' }}
-
-      - name: Upload Artifact
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.6.0
-        with:
-          name: browser-destinations-${{ github.event.inputs.environment }}-${{ steps.sha.outputs.sha }}
-          path: packages/browser-destinations/dist/web/
-          if-no-files-found: error
-          retention-days: 7
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 31cf096b00d..cd410561ae1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,6 +16,51 @@ on:
       - staging
 
 jobs:
+  build-browser-destinations:
+    env:
+      HUSKY: 0
+      NX_DISABLE_DB: true
+    if: startsWith(github.event.head_commit.message, 'Publish') == true
+    runs-on: ubuntu-latest-large
+    timeout-minutes: 20
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.x
+          cache: yarn
+
+      - name: Install Dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Build Destinations Manifest
+        run: yarn nx build @segment/destinations-manifest
+
+      - name: Build Production Browser Bundles
+        if: github.ref_name != 'staging'
+        working-directory: packages/browser-destinations
+        run: yarn build-web
+
+      - name: Build Stage Browser Bundles
+        if: github.ref_name == 'staging'
+        working-directory: packages/browser-destinations
+        run: yarn build-web-stage
+
+      - name: Upload Browser Destinations Artifact
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.6.0
+        with:
+          name: browser-destinations-${{ github.ref_name == 'staging' && 'stage' || 'production' }}-${{ github.sha }}
+          path: packages/browser-destinations/dist/web/
+          if-no-files-found: error
+          retention-days: 7
+
   build-and-publish:
     env:
       HUSKY: 0

From e03597340bad07d81021f360ba48ffc512c11288 Mon Sep 17 00:00:00 2001
From: Varadarajan V <vvijayaragavan@twilio.com>
Date: Fri, 7 Aug 2026 14:42:14 +0530
Subject: [PATCH 09/14] test: run browser artifact build on PR branch

---
 .github/workflows/publish.yml                 | 45 ------------------
 .../test-browser-destinations-artifact.yml    | 46 +++++++++++++++++++
 2 files changed, 46 insertions(+), 45 deletions(-)
 create mode 100644 .github/workflows/test-browser-destinations-artifact.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cd410561ae1..31cf096b00d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,51 +16,6 @@ on:
       - staging
 
 jobs:
-  build-browser-destinations:
-    env:
-      HUSKY: 0
-      NX_DISABLE_DB: true
-    if: startsWith(github.event.head_commit.message, 'Publish') == true
-    runs-on: ubuntu-latest-large
-    timeout-minutes: 20
-    permissions:
-      contents: read
-
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Use Node.js 22.x
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22.x
-          cache: yarn
-
-      - name: Install Dependencies
-        run: yarn install --frozen-lockfile
-
-      - name: Build Destinations Manifest
-        run: yarn nx build @segment/destinations-manifest
-
-      - name: Build Production Browser Bundles
-        if: github.ref_name != 'staging'
-        working-directory: packages/browser-destinations
-        run: yarn build-web
-
-      - name: Build Stage Browser Bundles
-        if: github.ref_name == 'staging'
-        working-directory: packages/browser-destinations
-        run: yarn build-web-stage
-
-      - name: Upload Browser Destinations Artifact
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.6.0
-        with:
-          name: browser-destinations-${{ github.ref_name == 'staging' && 'stage' || 'production' }}-${{ github.sha }}
-          path: packages/browser-destinations/dist/web/
-          if-no-files-found: error
-          retention-days: 7
-
   build-and-publish:
     env:
       HUSKY: 0
diff --git a/.github/workflows/test-browser-destinations-artifact.yml b/.github/workflows/test-browser-destinations-artifact.yml
new file mode 100644
index 00000000000..9eccb9bf3da
--- /dev/null
+++ b/.github/workflows/test-browser-destinations-artifact.yml
@@ -0,0 +1,46 @@
+name: Test Browser Destinations Artifact
+
+on:
+  push:
+    branches:
+      - build-browser-destinations-workflow
+
+permissions:
+  contents: read
+
+jobs:
+  build-browser-destinations:
+    env:
+      HUSKY: 0
+      NX_DISABLE_DB: true
+    runs-on: ubuntu-latest-large
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.x
+          cache: yarn
+
+      - name: Install Dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Build Destinations Manifest
+        run: yarn nx build @segment/destinations-manifest
+
+      - name: Build Production Browser Bundles
+        working-directory: packages/browser-destinations
+        run: yarn build-web
+
+      - name: Upload Browser Destinations Artifact
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.6.0
+        with:
+          name: browser-destinations-production-${{ github.sha }}
+          path: packages/browser-destinations/dist/web/
+          if-no-files-found: error
+          retention-days: 7

From 9bd277d7b7293d47b0608de1345d74dd9e9ed9be Mon Sep 17 00:00:00 2001
From: Varadarajan V <vvijayaragavan@twilio.com>
Date: Fri, 7 Aug 2026 14:47:17 +0530
Subject: [PATCH 10/14] chore: move validated browser build to publish

---
 .github/workflows/publish.yml                 | 45 ++++++++++++++++++
 .../test-browser-destinations-artifact.yml    | 46 -------------------
 2 files changed, 45 insertions(+), 46 deletions(-)
 delete mode 100644 .github/workflows/test-browser-destinations-artifact.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 31cf096b00d..cd410561ae1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,6 +16,51 @@ on:
       - staging
 
 jobs:
+  build-browser-destinations:
+    env:
+      HUSKY: 0
+      NX_DISABLE_DB: true
+    if: startsWith(github.event.head_commit.message, 'Publish') == true
+    runs-on: ubuntu-latest-large
+    timeout-minutes: 20
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.x
+          cache: yarn
+
+      - name: Install Dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Build Destinations Manifest
+        run: yarn nx build @segment/destinations-manifest
+
+      - name: Build Production Browser Bundles
+        if: github.ref_name != 'staging'
+        working-directory: packages/browser-destinations
+        run: yarn build-web
+
+      - name: Build Stage Browser Bundles
+        if: github.ref_name == 'staging'
+        working-directory: packages/browser-destinations
+        run: yarn build-web-stage
+
+      - name: Upload Browser Destinations Artifact
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.6.0
+        with:
+          name: browser-destinations-${{ github.ref_name == 'staging' && 'stage' || 'production' }}-${{ github.sha }}
+          path: packages/browser-destinations/dist/web/
+          if-no-files-found: error
+          retention-days: 7
+
   build-and-publish:
     env:
       HUSKY: 0
diff --git a/.github/workflows/test-browser-destinations-artifact.yml b/.github/workflows/test-browser-destinations-artifact.yml
deleted file mode 100644
index 9eccb9bf3da..00000000000
--- a/.github/workflows/test-browser-destinations-artifact.yml
+++ /dev/null
@@ -1,46 +0,0 @@
-name: Test Browser Destinations Artifact
-
-on:
-  push:
-    branches:
-      - build-browser-destinations-workflow
-
-permissions:
-  contents: read
-
-jobs:
-  build-browser-destinations:
-    env:
-      HUSKY: 0
-      NX_DISABLE_DB: true
-    runs-on: ubuntu-latest-large
-    timeout-minutes: 20
-
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Use Node.js 22.x
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22.x
-          cache: yarn
-
-      - name: Install Dependencies
-        run: yarn install --frozen-lockfile
-
-      - name: Build Destinations Manifest
-        run: yarn nx build @segment/destinations-manifest
-
-      - name: Build Production Browser Bundles
-        working-directory: packages/browser-destinations
-        run: yarn build-web
-
-      - name: Upload Browser Destinations Artifact
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.6.0
-        with:
-          name: browser-destinations-production-${{ github.sha }}
-          path: packages/browser-destinations/dist/web/
-          if-no-files-found: error
-          retention-days: 7

From 9d1f72df876f298aa14833037a82637a6cff52fa Mon Sep 17 00:00:00 2001
From: Varadarajan V <vvijayaragavan@twilio.com>
Date: Fri, 7 Aug 2026 14:50:03 +0530
Subject: [PATCH 11/14] chore: gate browser artifact builds on changes

---
 .github/workflows/publish.yml | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cd410561ae1..8f04cde986b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,11 +16,35 @@ on:
       - staging
 
 jobs:
+  detect-browser-destination-changes:
+    if: startsWith(github.event.head_commit.message, 'Publish') == true
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      changed: ${{ steps.changes.outputs.changed }}
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+          fetch-depth: 2
+
+      - name: Detect Browser Destination Changes
+        id: changes
+        run: |
+          if git diff --quiet HEAD^ HEAD -- packages/browser-destinations/; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
   build-browser-destinations:
+    needs: detect-browser-destination-changes
     env:
       HUSKY: 0
       NX_DISABLE_DB: true
-    if: startsWith(github.event.head_commit.message, 'Publish') == true
+    if: needs.detect-browser-destination-changes.outputs.changed == 'true'
     runs-on: ubuntu-latest-large
     timeout-minutes: 20
     permissions:

From a29e4a47afbaa732330260191c2130a82dc59ad1 Mon Sep 17 00:00:00 2001
From: Varadarajan V <vvijayaragavan@twilio.com>
Date: Fri, 7 Aug 2026 15:02:10 +0530
Subject: [PATCH 12/14] fix: harden browser artifact change detection

---
 .github/workflows/publish.yml | 45 +++++++++++++++++++++++++++++++----
 1 file changed, 40 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8f04cde986b..19b87dacbd5 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -20,6 +20,7 @@ jobs:
     if: startsWith(github.event.head_commit.message, 'Publish') == true
     runs-on: ubuntu-latest
     permissions:
+      actions: read
       contents: read
     outputs:
       changed: ${{ steps.changes.outputs.changed }}
@@ -28,15 +29,45 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
-          fetch-depth: 2
+          ref: ${{ github.sha }}
+          fetch-depth: 0
 
-      - name: Detect Browser Destination Changes
+      - name: Detect Browser Bundle Changes
         id: changes
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
-          if git diff --quiet HEAD^ HEAD -- packages/browser-destinations/; then
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-          else
+          previous_publish=''
+          while IFS=$'\t' read -r commit subject; do
+            if [[ "$subject" == Publish* ]]; then
+              previous_publish="$commit"
+              break
+            fi
+          done < <(git log --first-parent --format='%H%x09%s' HEAD^)
+
+          if [ -z "$previous_publish" ]; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
+          elif ! git diff --quiet "$previous_publish" HEAD -- \
+            packages/browser-destinations/ \
+            packages/browser-destination-runtime/ \
+            packages/core/ \
+            packages/actions-shared/ \
+            packages/ajv-human-errors/ \
+            packages/destination-subscriptions/; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            artifact_environment=${{ github.ref_name == 'staging' && 'stage' || 'production' }}
+            artifact_name="browser-destinations-${artifact_environment}-${previous_publish}"
+
+            if artifact_count=$(gh api --method GET \
+              "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts" \
+              -f name="$artifact_name" \
+              --jq '[.artifacts[] | select(.expired == false)] | length') && \
+              [ "$artifact_count" -gt 0 ]; then
+              echo "changed=false" >> "$GITHUB_OUTPUT"
+            else
+              echo "changed=true" >> "$GITHUB_OUTPUT"
+            fi
           fi
 
   build-browser-destinations:
@@ -54,6 +85,10 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
+          ref: ${{ github.sha }}
+
+      - name: Verify Checkout Commit
+        run: test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
 
       - name: Use Node.js 22.x
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

From 88aa2efdf56bac01fe507fc35041a467ae97234d Mon Sep 17 00:00:00 2001
From: Varadarajan V <vvijayaragavan@twilio.com>
Date: Fri, 7 Aug 2026 21:18:18 +0530
Subject: [PATCH 13/14] chore: split browser artifact publishing workflow

---
 .../publish-browser-destinations.yml          | 114 ++++++++++++++++++
 .github/workflows/publish.yml                 | 104 ----------------
 2 files changed, 114 insertions(+), 104 deletions(-)
 create mode 100644 .github/workflows/publish-browser-destinations.yml

diff --git a/.github/workflows/publish-browser-destinations.yml b/.github/workflows/publish-browser-destinations.yml
new file mode 100644
index 00000000000..76878e9d9a9
--- /dev/null
+++ b/.github/workflows/publish-browser-destinations.yml
@@ -0,0 +1,114 @@
+# Short-term workflow for producing browser destination artifacts independently
+# from npm package publishing. Both workflows start concurrently on Publish pushes.
+name: Publish Browser Destination Workflow
+
+on:
+  push:
+    branches:
+      - main
+      - staging
+
+jobs:
+  detect-browser-destination-changes:
+    if: startsWith(github.event.head_commit.message, 'Publish') == true
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+    outputs:
+      changed: ${{ steps.changes.outputs.changed }}
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+
+      - name: Detect Browser Bundle Changes
+        id: changes
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          previous_publish=''
+          while IFS=$'\t' read -r commit subject; do
+            if [[ "$subject" == Publish* ]]; then
+              previous_publish="$commit"
+              break
+            fi
+          done < <(git log --first-parent --format='%H%x09%s' HEAD^)
+
+          if [ -z "$previous_publish" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          elif ! git diff --quiet "$previous_publish" HEAD -- \
+            packages/browser-destinations/ \
+            packages/browser-destination-runtime/ \
+            packages/core/ \
+            packages/actions-shared/ \
+            packages/ajv-human-errors/ \
+            packages/destination-subscriptions/; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            artifact_environment=${{ github.ref_name == 'staging' && 'stage' || 'production' }}
+            artifact_name="browser-destinations-${artifact_environment}-${previous_publish}"
+
+            if artifact_count=$(gh api --method GET \
+              "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts" \
+              -f name="$artifact_name" \
+              --jq '[.artifacts[] | select(.expired == false)] | length') && \
+              [ "$artifact_count" -gt 0 ]; then
+              echo "changed=false" >> "$GITHUB_OUTPUT"
+            else
+              echo "changed=true" >> "$GITHUB_OUTPUT"
+            fi
+          fi
+
+  build-browser-destinations:
+    needs: detect-browser-destination-changes
+    env:
+      HUSKY: 0
+      NX_DISABLE_DB: true
+    if: needs.detect-browser-destination-changes.outputs.changed == 'true'
+    runs-on: ubuntu-latest-large
+    timeout-minutes: 20
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+
+      - name: Verify Checkout Commit
+        run: test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.x
+          cache: yarn
+
+      - name: Install Dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Build Destinations Manifest
+        run: yarn nx build @segment/destinations-manifest
+
+      - name: Build Production Browser Bundles
+        if: github.ref_name == 'main'
+        working-directory: packages/browser-destinations
+        run: yarn build-web
+
+      - name: Build Stage Browser Bundles
+        if: github.ref_name == 'staging'
+        working-directory: packages/browser-destinations
+        run: yarn build-web-stage
+
+      - name: Upload Browser Destinations Artifact
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.6.0
+        with:
+          name: browser-destinations-${{ github.ref_name == 'staging' && 'stage' || 'production' }}-${{ github.sha }}
+          path: packages/browser-destinations/dist/web/
+          if-no-files-found: error
+          retention-days: 7
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 19b87dacbd5..31cf096b00d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,110 +16,6 @@ on:
       - staging
 
 jobs:
-  detect-browser-destination-changes:
-    if: startsWith(github.event.head_commit.message, 'Publish') == true
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-    outputs:
-      changed: ${{ steps.changes.outputs.changed }}
-
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-          ref: ${{ github.sha }}
-          fetch-depth: 0
-
-      - name: Detect Browser Bundle Changes
-        id: changes
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          previous_publish=''
-          while IFS=$'\t' read -r commit subject; do
-            if [[ "$subject" == Publish* ]]; then
-              previous_publish="$commit"
-              break
-            fi
-          done < <(git log --first-parent --format='%H%x09%s' HEAD^)
-
-          if [ -z "$previous_publish" ]; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          elif ! git diff --quiet "$previous_publish" HEAD -- \
-            packages/browser-destinations/ \
-            packages/browser-destination-runtime/ \
-            packages/core/ \
-            packages/actions-shared/ \
-            packages/ajv-human-errors/ \
-            packages/destination-subscriptions/; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          else
-            artifact_environment=${{ github.ref_name == 'staging' && 'stage' || 'production' }}
-            artifact_name="browser-destinations-${artifact_environment}-${previous_publish}"
-
-            if artifact_count=$(gh api --method GET \
-              "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts" \
-              -f name="$artifact_name" \
-              --jq '[.artifacts[] | select(.expired == false)] | length') && \
-              [ "$artifact_count" -gt 0 ]; then
-              echo "changed=false" >> "$GITHUB_OUTPUT"
-            else
-              echo "changed=true" >> "$GITHUB_OUTPUT"
-            fi
-          fi
-
-  build-browser-destinations:
-    needs: detect-browser-destination-changes
-    env:
-      HUSKY: 0
-      NX_DISABLE_DB: true
-    if: needs.detect-browser-destination-changes.outputs.changed == 'true'
-    runs-on: ubuntu-latest-large
-    timeout-minutes: 20
-    permissions:
-      contents: read
-
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-          ref: ${{ github.sha }}
-
-      - name: Verify Checkout Commit
-        run: test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
-
-      - name: Use Node.js 22.x
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 22.x
-          cache: yarn
-
-      - name: Install Dependencies
-        run: yarn install --frozen-lockfile
-
-      - name: Build Destinations Manifest
-        run: yarn nx build @segment/destinations-manifest
-
-      - name: Build Production Browser Bundles
-        if: github.ref_name != 'staging'
-        working-directory: packages/browser-destinations
-        run: yarn build-web
-
-      - name: Build Stage Browser Bundles
-        if: github.ref_name == 'staging'
-        working-directory: packages/browser-destinations
-        run: yarn build-web-stage
-
-      - name: Upload Browser Destinations Artifact
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.6.0
-        with:
-          name: browser-destinations-${{ github.ref_name == 'staging' && 'stage' || 'production' }}-${{ github.sha }}
-          path: packages/browser-destinations/dist/web/
-          if-no-files-found: error
-          retention-days: 7
-
   build-and-publish:
     env:
       HUSKY: 0

From dbeb7da19dbe52fa13311a75e1cdbfaf041a6623 Mon Sep 17 00:00:00 2001
From: Varadarajan V <vvijayaragavan@twilio.com>
Date: Fri, 7 Aug 2026 21:24:07 +0530
Subject: [PATCH 14/14] fix: harden browser artifact lookup

---
 .github/workflows/publish-browser-destinations.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish-browser-destinations.yml b/.github/workflows/publish-browser-destinations.yml
index 76878e9d9a9..4fee2fea5d6 100644
--- a/.github/workflows/publish-browser-destinations.yml
+++ b/.github/workflows/publish-browser-destinations.yml
@@ -28,6 +28,7 @@ jobs:
       - name: Detect Browser Bundle Changes
         id: changes
         env:
+          ARTIFACT_ENVIRONMENT: ${{ github.ref_name == 'staging' && 'stage' || 'production' }}
           GH_TOKEN: ${{ github.token }}
         run: |
           previous_publish=''
@@ -49,13 +50,15 @@ jobs:
             packages/destination-subscriptions/; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
           else
-            artifact_environment=${{ github.ref_name == 'staging' && 'stage' || 'production' }}
-            artifact_name="browser-destinations-${artifact_environment}-${previous_publish}"
+            artifact_name="browser-destinations-${ARTIFACT_ENVIRONMENT}-${previous_publish}"
 
-            if artifact_count=$(gh api --method GET \
+            if artifacts=$(gh api --method GET \
               "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts" \
               -f name="$artifact_name" \
-              --jq '[.artifacts[] | select(.expired == false)] | length') && \
+              -f per_page=100) && \
+              artifact_count=$(jq --arg name "$artifact_name" \
+                '[.artifacts[] | select(.name == $name and .expired == false)] | length' \
+                <<< "$artifacts") && \
               [ "$artifact_count" -gt 0 ]; then
               echo "changed=false" >> "$GITHUB_OUTPUT"
             else