Distribute React Native DevTools binaries via GitHub Releases (facebook#52930)

Summary:
bypass-github-export-checks

OSS release infrastructure for the (experimental) React Native DevTools standalone shell.

Currently, binaries are built continuously on Meta infra and served from the Meta CDN using fbcdn.net URLs checked into a DotSlash file in the repo, e.g.:

https://github.com/facebook/react-native/blob/15373218ec572c0e43325845b80a849ad5174cc3/packages/debugger-shell/bin/react-native-devtools#L9-L18

For open source releases we want to primarily distribute the binaries as GitHub release assets, while keeping the Meta CDN URLs as a secondary option. This PR makes the necessary changes to the release workflows to support this:

* `workflows/create-release.yml` (modified): As part of the release commit, rewrite the DotSlash file to include the release asset URLs.
  * **NOTE:** After this commit, **the new URLs don't work yet**, because they refer to a release that hasn't been published. Despite this, the DotSlash file remains valid and usable (because DotSlash will happily fall back to the Meta CDN URLs, which are still in the file).
* `workflows/create-draft-release.yml` (modified): After creating a draft release, fetch the binaries from the Meta CDN and reupload them to GitHub as release assets. This is based on the contents of the DotSlash file rewritten by `create-release.yml`.
* `workflows/validate-dotslash-artifacts.yml` (new): After the release is published, all URLs referenced by the DotSlash (both Meta CDN URL and GH release asset URLs) should be valid and refer to the same artifacts. This workflow checks that this is the case.
  * If this workflow fails on a published release, the release may need to be burned or a hotfix release may be necessary - as the release will stop working correctly once the Meta CDN stops serving the assets.
  * This workflow will also be running continuously on `main`. If it fails on a commit in `main`, there might be a connectivity issue between the GHA runner and the Meta CDN, or there might be an issue on the Meta side.

NOTE: These changes to the release pipeline are generic and reusable; if we later add another DotSlash-based tool whose binaries need to be mirrored as GitHub release assets, we just need to add it to the `FIRST_PARTY_DOTSLASH_FILES` array.

[Internal] Mirror React Native DevTools binaries in GitHub Releases

Pull Request resolved: facebook#52930

Test Plan:

I've added unit tests for `dotslash-utils`, `curl-utils`, and for the majority of the logic that makes up the new release scripts (`write-dotslash-release-assets-urls`, `upload-release-assets-for-dotslash`, `validate-dotslash-artifacts`).

Created a test branch and draft PR: facebook#53147.

Locally created a release commit, simulating the create-release GH workflow:

```
node scripts/releases/create-release-commit.js --reactNativeVersion 0.82.0-20250903-0830 --no-dry-run
```

This updated the DotSlash file in the branch: facebook@2deeb7e#diff-205a9ff6005e30be061eaa64b9cb50b15b0e909dd188e0866189e952655a3483

NOTE: I've also ensured that the `create-release-commit` script correctly updates the DotSlash file when running from a branch that already has a release commit - see screenshot:
<img width="1483" height="587" alt="image" src="https://github.com/user-attachments/assets/1ffd859b-e02b-483d-8067-9cc9116829a4" />

Enabled testing the create-draft-release GH workflow in the test branch using these temporary hacks:

* facebook@81f334e
* facebook@6d88516
* facebook@1428a8d

Workflow run: https://github.com/facebook/react-native/actions/runs/17426711373/job/49475327346
Draft release: https://github.com/facebook/react-native/releases/tag/untagged-c6a62a58e5baa37936e1
Draft release screenshot for posterity (since we'll likely delete the draft release after landing this):

<img width="1024" height="814" alt="image" src="https://github.com/user-attachments/assets/1900da15-48f6-4274-b29c-0ac2019d92c0" />

For obvious reasons, I've avoided actually publishing the above draft release. But I have run the `validate-dotslash-artifacts` workflow on the *current* branch to ensure that the logic is correct: https://github.com/motiz88/react-native/actions/runs/17426885205/job/49475888486

Running `node scripts/releases/validate-dotslash-artifacts.js` in the release branch (without publishing the release first) fails, as expected:

<img width="1105" height="748" alt="image" src="https://github.com/user-attachments/assets/ed23a2e2-7a31-42eb-a324-f1d50eafe2fb" />

This PR is all the infra needed ahead of the 0.82 ~~branch cut~~ infra freeze to support the React Native DevTools standalone shell, at least on the GitHub side. ~~Some minor infra work remains on the Meta side, plus some product/logic changes to the React Native DevTools standalone shell that I'm intending to finish in time for 0.82 (for an experimental rollout).~~ EDIT: All the planned work has landed; the feature is code-complete on `main` as well as in `0.82-stable` (apart from this infra change).

As a one-off, once we've actually published 0.82.0-rc.1, we'll want to have a human look at the published artifacts and CI workflow logs to ensure everything is in order. (I'll make sure to communicate this to the 0.82 release crew.) Afterwards, the automation added in this PR should be sufficient.

Reviewed By: huntie

Differential Revision: D81578704

Pulled By: motiz88

fbshipit-source-id: 6a4a48c3713221a89dd5fc88851674c1ddc6bb10

Author: motiz88

.github/workflow-scripts/__tests__/createDraftRelease-test.js

@@ -188,6 +188,7 @@ View the whole changelog in the [CHANGELOG.md file](https://github.com/facebook/
           status: 201,
           json: () =>
             Promise.resolve({
+              id: 1,
               html_url:
                 'https://github.com/facebook/react-native/releases/tag/v0.77.1',
             }),
@@ -208,9 +209,11 @@ View the whole changelog in the [CHANGELOG.md file](https://github.com/facebook/
           body: fetchBody,
         },
       );
-      expect(response).toEqual(
-        'https://github.com/facebook/react-native/releases/tag/v0.77.1',
-      );
+      expect(response).toEqual({
+        id: 1,
+        html_url:
+          'https://github.com/facebook/react-native/releases/tag/v0.77.1',
+      });
     });
 
     it('creates a draft release for prerelease on GitHub', async () => {
@@ -238,6 +241,7 @@ View the whole changelog in the [CHANGELOG.md file](https://github.com/facebook/
           status: 201,
           json: () =>
             Promise.resolve({
+              id: 1,
               html_url:
                 'https://github.com/facebook/react-native/releases/tag/v0.77.1',
             }),
@@ -258,9 +262,11 @@ View the whole changelog in the [CHANGELOG.md file](https://github.com/facebook/
           body: fetchBody,
         },
       );
-      expect(response).toEqual(
-        'https://github.com/facebook/react-native/releases/tag/v0.77.1',
-      );
+      expect(response).toEqual({
+        id: 1,
+        html_url:
+          'https://github.com/facebook/react-native/releases/tag/v0.77.1',
+      });
     });
 
     it('throws if the post failes', async () => {

.github/workflow-scripts/createDraftRelease.js

@@ -101,7 +101,11 @@ async function _createDraftReleaseOnGitHub(version, body, latest, token) {
   }
 
   const data = await response.json();
-  return data.html_url;
+  const {html_url, id} = data;
+  return {
+    html_url,
+    id,
+  };
 }
 
 function moveToChangelogBranch(version) {
@@ -124,7 +128,8 @@ async function createDraftRelease(version, latest, token) {
     latest,
     token,
   );
-  log(`Created draft release: ${release}`);
+  log(`Created draft release: ${release.html_url}, ID ${release.id}`);
+  return release;
 }
 
 module.exports = {

.github/workflows/create-draft-release.yml

@@ -21,9 +21,24 @@ jobs:
           git config --local user.name "React Native Bot"
       - name: Create draft release
         uses: actions/github-script@v6
+        id: create-draft-release
         with:
           script: |
             const {createDraftRelease} = require('./.github/workflow-scripts/createDraftRelease.js');
             const version = '${{ github.ref_name }}';
             const {isLatest} = require('./.github/workflow-scripts/publishTemplate.js');
-            await createDraftRelease(version, isLatest(), '${{secrets.REACT_NATIVE_BOT_GITHUB_TOKEN}}');
+            return (await createDraftRelease(version, isLatest(), '${{secrets.REACT_NATIVE_BOT_GITHUB_TOKEN}}')).id;
+          result-encoding: string
+      - name: Upload release assets for DotSlash
+        uses: actions/github-script@v6
+        env:
+          RELEASE_ID: ${{ steps.create-draft-release.outputs.result }}
+        with:
+          script: |
+            const {uploadReleaseAssetsForDotSlashFiles} = require('./scripts/releases/upload-release-assets-for-dotslash.js');
+            const version = '${{ github.ref_name }}';
+            await uploadReleaseAssetsForDotSlashFiles({
+              version,
+              token: '${{secrets.REACT_NATIVE_BOT_GITHUB_TOKEN}}',
+              releaseId: process.env.RELEASE_ID,
+            });

.github/workflows/validate-dotslash-artifacts.yml

@@ -0,0 +1,48 @@
+name: Validate DotSlash Artifacts
+
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+  push:
+    branches:
+      - main
+    paths:
+      - packages/debugger-shell/bin/react-native-devtools
+      - "scripts/releases/**"
+      - package.json
+      - yarn.lock
+  pull_request:
+    branches:
+      - main
+    paths:
+      - packages/debugger-shell/bin/react-native-devtools
+      - "scripts/releases/**"
+      - package.json
+      - yarn.lock
+  # Same time as the nightly build: 2:15 AM UTC
+  schedule:
+    - cron: "15 2 * * *"
+
+jobs:
+  validate-dotslash-artifacts:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+      - name: Install dependencies
+        uses: ./.github/actions/yarn-install
+      - name: Configure Git
+        shell: bash
+        run: |
+          git config --local user.email "[email protected]"
+          git config --local user.name "React Native Bot"
+      - name: Validate DotSlash artifacts
+        uses: actions/github-script@v6
+        with:
+          script: |
+            const {validateDotSlashArtifacts} = require('./scripts/releases/validate-dotslash-artifacts.js');
+            await validateDotSlashArtifacts();

flow-typed/npm/@expo/spawn-async_v1.x.x.js

@@ -0,0 +1,46 @@
+/**
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ *
+ * @flow strict-local
+ * @format
+ */
+
+declare module '@expo/spawn-async' {
+  type SpawnOptions = {
+    cwd?: string,
+    env?: Object,
+    argv0?: string,
+    stdio?: string | Array<any>,
+    detached?: boolean,
+    uid?: number,
+    gid?: number,
+    shell?: boolean | string,
+    windowsVerbatimArguments?: boolean,
+    windowsHide?: boolean,
+    encoding?: string,
+    ignoreStdio?: boolean,
+  };
+
+  declare class SpawnPromise<T> extends Promise<T> {
+    child: child_process$ChildProcess;
+  }
+  type SpawnResult = {
+    pid?: number,
+    output: string[],
+    stdout: string,
+    stderr: string,
+    status: number | null,
+    signal: string | null,
+  };
+
+  declare function spawnAsync(
+    command: string,
+    args?: $ReadOnlyArray<string>,
+    options?: SpawnOptions,
+  ): SpawnPromise<SpawnResult>;
+
+  declare module.exports: typeof spawnAsync;
+}

flow-typed/npm/@octokit/rest_v22.x.x.js

@@ -0,0 +1,61 @@
+/**
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ *
+ * @flow strict-local
+ * @format
+ */
+
+// Partial types for Octokit based on the usage in react-native-github
+declare module '@octokit/rest' {
+  declare class Octokit {
+    constructor(options?: {auth?: string, ...}): this;
+
+    repos: $ReadOnly<{
+      listReleaseAssets: (
+        params: $ReadOnly<{
+          owner: string,
+          repo: string,
+          release_id: string,
+        }>,
+      ) => Promise<{
+        data: Array<{
+          id: string,
+          name: string,
+          ...
+        }>,
+        ...
+      }>,
+      uploadReleaseAsset: (
+        params: $ReadOnly<{
+          owner: string,
+          repo: string,
+          release_id: string,
+          name: string,
+          data: Buffer,
+          headers: $ReadOnly<{
+            'content-type': string,
+            ...
+          }>,
+          ...
+        }>,
+      ) => Promise<{
+        data: {
+          browser_download_url: string,
+          ...
+        },
+        ...
+      }>,
+      deleteReleaseAsset: (params: {
+        owner: string,
+        repo: string,
+        asset_id: string,
+        ...
+      }) => Promise<mixed>,
+    }>;
+  }
+
+  declare export {Octokit};
+}

flow-typed/npm/fb-dotslash_v0.x.x.js

@@ -0,0 +1,13 @@
+/**
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ *
+ * @flow strict-local
+ * @format
+ */
+
+declare module 'fb-dotslash' {
+  declare module.exports: string;
+}