feat: add reusable publish-preview workflow by cryptodev-2s · Pull Request #223 · MetaMask/github-tools

cryptodev-2s · 2026-02-26T15:10:14Z

Add a reusable workflow_call workflow so consumer repos can replace their copy-pasted publish-preview.yml with a thin wrapper.

New files

.github/workflows/publish-preview.yml — Reusable workflow with 4 jobs: fork check, comment reaction, build (no token), publish (with token). Supports both monorepos and polyrepos via is-monorepo input.
.github/scripts/generate-preview-build-message.sh — Generates the PR comment (collapsible package list for monorepos, single install command for polyrepos).
.github/actions/prepare-preview-builds/ — Composite action for monorepo manifest preparation (from prior commit).

Consumer example

Polyrepo working example cryptodev-2s/core#3
Monorepo working example cryptodev-2s/create-release-branch#3

name: Publish a preview build
on:
  issue_comment:
    types: created
jobs:
  publish-preview:
    if: ${{ github.event.issue.pull_request && startsWith(github.event.comment.body, '@metamaskbot publish-preview') }}
    uses: MetaMask/github-tools/.github/workflows/publish-preview.yml@v2
    with:
      is-monorepo: false  # omit for monorepos (default: true)
      environment: default-branch  # optional
    secrets:
      PUBLISH_PREVIEW_NPM_TOKEN: ${{ secrets.PUBLISH_PREVIEW_NPM_TOKEN }}

Note

Medium Risk
Introduces a new GitHub Actions workflow that publishes to NPM using a secret token; mistakes could leak credentials or publish incorrect packages, though the workflow includes manifest sanitization and registry validation to mitigate this.

Overview
Adds a reusable workflow_call workflow (.github/workflows/publish-preview.yml) that builds PR-based preview NPM packages and posts the published versions back to the PR.

The workflow supports monorepos and polyrepos, rewrites package names/versions to a preview scope with a commit-SHA suffix, uploads build artifacts, then publishes from a separate job gated by an optional GitHub environment.

It also adds safety checks for non-fork PRs and sanitizes downloaded package.json files before publishing by stripping pack/publish/prepare lifecycle scripts and rejecting non-registry.npmjs.org registries.

^{Written by Cursor Bugbot for commit 4c4c413. This will update automatically on new commits. Configure here.}

Extract the preview build preparation logic into a reusable composite GitHub Action so other repos can use the same logic. The jq filter is inlined and the source scope is parameterized.

.github/actions/prepare-preview-builds/action.yml

mcmire · 2026-02-26T16:09:42Z

@cryptodev-2s What are your thoughts on supporting the entire preview build workflow rather than just the "generate preview builds" step? Recently, we've added support for preview builds to other polyrepos, but currently we have to copy around the workflows. It would be nice to consolidate all of the steps into this repo. And we could make the action support both monorepos and polyrepos. What do you think?

cryptodev-2s · 2026-02-26T16:11:02Z

@cryptodev-2s What are your thoughts on supporting the entire preview build workflow rather than just the "generate preview builds" step? Recently, we've added support for preview builds to other polyrepos, but currently we have to copy around the workflows. It would be nice to consolidate all of the steps into this repo. And we could make the action support both monorepos and polyrepos. What do you think?

Yes make sense, let me do this.

Add a `workflow_call` workflow that handles the full preview build flow (fork check, comment reaction, build, publish) for both monorepos and polyrepos. Consumer repos only need a ~13-line thin wrapper with the `issue_comment` trigger. Also add a centralized `generate-preview-build-message.sh` script that auto-detects mono vs polyrepo and produces the appropriate PR comment.

.github/workflows/publish-preview.yml

cursor · 2026-03-04T19:36:10Z

.github/workflows/publish-preview.yml

+            !./packages/*/node_modules/
+            !./packages/*/src/
+            !./packages/*/tests/
+            !./packages/**/*.test.*


Monorepo artifact paths hardcode packages/ directory structure

Medium Severity

The monorepo upload glob ./packages/*/ and the sanitization find packages both hardcode the packages/ directory. However, prepare-preview-builds.sh dynamically discovers workspaces via yarn workspaces list, which works for any directory layout. Monorepos with workspaces outside packages/ (e.g., libs/, modules/) would have their manifests prepared but the built output wouldn't be uploaded or security-validated before publishing.

Additional Locations (1)

.github/workflows/publish-preview.yml#L196-L197

All MetaMask monorepos use packages/, this matches the existing core workflow convention. If a repo ever uses a different layout, we can add a workspace-glob input then.

We could generate this glob automatically by looping through the workspaces field in package.json. But yes I agree that probably don't need to worry about this for v1.

.github/workflows/publish-preview.yml

.github/scripts/generate-preview-build-message.sh

.github/scripts/prepare-preview-builds.sh

.github/scripts/generate-preview-build-message.sh

.github/workflows/publish-preview.yml

mcmire · 2026-03-05T21:39:43Z

.github/workflows/publish-preview.yml

+            !./packages/*/node_modules/
+            !./packages/*/src/
+            !./packages/*/tests/
+            !./packages/**/*.test.*


We could generate this glob automatically by looping through the workspaces field in package.json. But yes I agree that probably don't need to worry about this for v1.

.github/workflows/publish-preview.yml

.github/scripts/generate-preview-build-message.sh

cursor · 2026-03-09T17:02:37Z

.github/workflows/publish-preview.yml

+          if [[ "$IS_MONOREPO" == "true" ]]; then
+            mapfile -t manifests < <(find packages -name package.json -not -path '*/node_modules/*')
+          else
+            manifests=(package.json)


Monorepo sanitization skips root package.json manifest

Medium Severity

In monorepo mode, the sanitization step only scans packages/ for package.json files but the root package.json is also included in the uploaded artifacts (line 142). A malicious PR could inject lifecycle scripts (e.g., postinstall) into the root package.json, which would execute during the yarn install --no-immutable step in the publish job. While the NPM token isn't in the environment at that point, the GITHUB_TOKEN with pull-requests: write permission is accessible to the running process.

allow-scripts already takes care of this, so I think we are okay?

Yes not a real concern

mcmire

A few things I noticed, but they are non-blocking. LGTM.

.github/workflows/publish-preview.yml

Mrtenz · 2026-03-17T08:54:51Z

.github/workflows/publish-preview.yml

+          SOURCE_SCOPE: ${{ inputs.source-scope }}
+          IS_MONOREPO: ${{ inputs.is-monorepo }}
+        run: |
+          prepare_manifest() {


Some of the scripts in this workflow could probably be made easier to read/maintain by using actions/github-script.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

cursor · 2026-03-17T14:01:21Z

.github/workflows/publish-preview.yml

+          path: |
+            .
+            !./node_modules/
+            !./.git/


Polyrepo artifact includes config files bypassing registry check

Medium Severity

The polyrepo artifact uploads the entire working tree (minus node_modules and .git), which includes .yarnrc.yml. The sanitization step only validates publishConfig.registry in package.json files. A malicious PR could set npmRegistryServer or npmScopes in .yarnrc.yml to redirect yarn npm publish to an attacker-controlled server, exfiltrating the PUBLISH_PREVIEW_NPM_TOKEN. The monorepo path is not affected since its artifact only includes specific paths.

Additional Locations (1)

.github/workflows/publish-preview.yml#L200-L229

Well, we need .yarnrc.yml to run yarn. I guess this is true though. Do we need to perform validation on .yarnrc.yml too? This is getting a bit out of hand 🫤

fixed here 71a6577

That's a good fix.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

cursor · 2026-03-17T14:33:32Z

.github/workflows/publish-preview.yml

+    name: Publish preview
+    needs: build-preview
+    permissions:
+      pull-requests: write


Missing contents: read permission breaks checkout step

High Severity

The publish-preview job sets permissions: pull-requests: write without including contents: read. When explicit permissions are set, all unspecified scopes default to none. The MetaMask/action-checkout-and-setup@v2 action performs a git checkout internally, which requires contents: read. Comparing with create-release-pr.yml in this same repo, which correctly specifies both contents: write and pull-requests: write when using the same action, confirms this is an oversight. This will cause the checkout to fail, at minimum for private repos.

Additional Locations (1)

.github/workflows/publish-preview.yml#L183-L187

fixed here 4c4c413

mcmire

LGTM!

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

cursor · 2026-03-17T14:56:08Z

.github/workflows/publish-preview.yml

+          path: |
+            .
+            !./node_modules/
+            !./.git/


Polyrepo artifacts include unsanitized .yarnrc.yml config

Medium Severity

The polyrepo artifact upload includes the entire workspace (excluding only node_modules/ and .git/), which means .yarnrc.yml from the PR branch is included. The sanitize step only validates package.json files for unexpected registries but does not inspect .yarnrc.yml. A malicious PR could add npmScopes.metamask-previews.npmRegistryServer pointing to an attacker-controlled URL, causing yarn npm publish to send the YARN_NPM_AUTH_TOKEN to that server. YARN_NPM_REGISTRY_SERVER only overrides the global npmRegistryServer, not scoped registries.

Additional Locations (1)

.github/workflows/publish-preview.yml#L201-L230

feat: add prepare-preview-builds composite action

06b127c

Extract the preview build preparation logic into a reusable composite GitHub Action so other repos can use the same logic. The jq filter is inlined and the source scope is parameterized.

cryptodev-2s mentioned this pull request Feb 26, 2026

feat: use reusable publish-preview workflow from github-tools MetaMask/core#8050

Draft

cryptodev-2s self-assigned this Feb 26, 2026

cryptodev-2s added the team-core-platform label Feb 26, 2026

cryptodev-2s marked this pull request as ready for review February 26, 2026 15:37

cursor bot reviewed Feb 26, 2026

View reviewed changes

.github/actions/prepare-preview-builds/action.yml Outdated Show resolved Hide resolved

cryptodev-2s changed the title ~~feat: add prepare-preview-builds composite action~~ feat: add reusable publish-preview workflow Feb 26, 2026

cryptodev-2s added 3 commits February 27, 2026 00:27

fix: use absolute script path in prepare-preview-builds action

5a9d9bc

test: point prepare-preview-builds action at branch ref

0f2aa18

fix: resolve github-tools ref from github.workflow_ref

08df742

cursor bot reviewed Feb 27, 2026

View reviewed changes

.github/workflows/publish-preview.yml Outdated Show resolved Hide resolved

cryptodev-2s requested review from Mrtenz and mcmire March 4, 2026 15:04

cryptodev-2s added 2 commits March 4, 2026 15:31

fix: run yarn install after polyrepo package rename

c65f89b

fix: strip lifecycle scripts from artifacts instead of failing

fa010ba

cursor bot reviewed Mar 4, 2026

View reviewed changes

cryptodev-2s added 2 commits March 5, 2026 15:30

fix: also strip prepare lifecycle script from artifacts

fad8410

refactor: pass monorepo/polyrepo flag explicitly to message script

5fa209e

cryptodev-2s requested review from FrederikBolding, Gudahtt and GuillaumeRx March 5, 2026 15:54

mcmire reviewed Mar 5, 2026

View reviewed changes

cryptodev-2s added 2 commits March 9, 2026 16:18

refactor: address review feedback

788fc30

feat: add dry-run input to skip NPM publish

ea06dbd

cursor bot reviewed Mar 9, 2026

View reviewed changes

.github/scripts/generate-preview-build-message.sh Outdated Show resolved Hide resolved

cryptodev-2s added 2 commits March 9, 2026 16:44

fix: monorepo docs link appearing on wrong line

03bc0ee

fix: inline message generation, remove github-tools checkout

d4696d1

chore: remove unused generate-preview-build-message.sh

9db8b7e

cursor bot reviewed Mar 9, 2026

View reviewed changes

cryptodev-2s requested a review from mcmire March 9, 2026 17:10

refactor: inline prepare-preview-builds into workflow

7f99a4e

mcmire previously approved these changes Mar 16, 2026

View reviewed changes

.github/workflows/publish-preview.yml Show resolved Hide resolved

.github/workflows/publish-preview.yml Show resolved Hide resolved

.github/workflows/publish-preview.yml Outdated Show resolved Hide resolved

Mrtenz reviewed Mar 17, 2026

View reviewed changes

fix: improve preview builds docs link wording

4ae7a7f

cryptodev-2s dismissed mcmire’s stale review via 4ae7a7f March 17, 2026 13:38

cryptodev-2s requested a review from mcmire March 17, 2026 13:41

cryptodev-2s and others added 2 commits March 17, 2026 14:42

Merge branch 'main' into prepare-preview-builds-action

8a99beb

fix: move period outside link text in docs link

26c411a

cursor bot reviewed Mar 17, 2026

View reviewed changes

fix: pin npm registry in publish steps to prevent .yarnrc.yml override

71a6577

cursor bot reviewed Mar 17, 2026

View reviewed changes

fix: add contents:read permission to publish-preview job

4c4c413

mcmire approved these changes Mar 17, 2026

View reviewed changes

cursor bot reviewed Mar 17, 2026

View reviewed changes

cryptodev-2s merged commit f526fda into main Mar 17, 2026
21 checks passed

cryptodev-2s deleted the prepare-preview-builds-action branch March 17, 2026 15:04

cryptodev-2s mentioned this pull request Mar 17, 2026

fix: sanitize .yarnrc.yml in publish-preview to prevent token exfiltration #227

Merged

Uh oh!

Conversation

cryptodev-2s commented Feb 26, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New files

Consumer example

Uh oh!

Uh oh!

mcmire commented Feb 26, 2026

Uh oh!

cryptodev-2s commented Feb 26, 2026

Uh oh!

Uh oh!

Uh oh!

cursor bot Mar 4, 2026

Choose a reason for hiding this comment

Monorepo artifact paths hardcode packages/ directory structure

Uh oh!

cryptodev-2s Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mcmire Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mcmire Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursor bot Mar 9, 2026

Choose a reason for hiding this comment

Monorepo sanitization skips root package.json manifest

Uh oh!

mcmire Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

cryptodev-2s Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

mcmire left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mrtenz Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Mar 17, 2026

Choose a reason for hiding this comment

Polyrepo artifact includes config files bypassing registry check

Uh oh!

mcmire Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cryptodev-2s Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

mcmire Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Mar 17, 2026

Choose a reason for hiding this comment

cryptodev-2s commented Feb 26, 2026 •

edited by cursor bot

Loading

Monorepo artifact paths hardcode `packages/` directory structure

cryptodev-2s Mar 5, 2026 •

edited

Loading

Mrtenz Mar 17, 2026 •

edited

Loading

mcmire Mar 17, 2026 •

edited

Loading

Missing `contents: read` permission breaks checkout step

Polyrepo artifacts include unsanitized `.yarnrc.yml` config