chore(ci): record published version in the SDK release catalog (SDK-7358) [v8]

[shivam5643]

What is this about?

Adds the SDK-7358 release-catalog callback to the release workflow — v8 line.

Clean cherry-pick of #204 (v9 / main); the resulting release.yml is byte-identical across both lines.

railsApp derives a version's tier — stable / outdated / deprecated — from the
sdk_version_releases catalog. The catalog is seeded by a one-shot backfill that scrapes the
public registries. Without a callback from the release path it only advances when someone
re-runs that backfill, so a version published today looks missing to railsApp: customers on
it get no nudge, and its age clock never starts.

The equivalent hook for node, java, python and ruby lives in browserstack-cd, because those
four publish from Jenkins. This service publishes from GitHub Actions, so its hook has to
live here. (The old Jenkins job WdioServiceNpmPackagePublish was disabled on 2026-08-19 per
SDK-6957/APPSEC-537 and is not the hook point; the preprod packers only upload tarballs and
never npm publish.)

Recorded under language ecmascript — a separate catalog line from node. Sending node
here would merge this service's releases into the node-agent catalog.

Two design points worth a reviewer's eye:

• It reads steps.publish.outputs.published / publishedPackages from the pinned
  changesets/action rather than re-deriving the version, so it fires only when something
  was actually published. When changesets are still pending the action opens the Version PR
  and publishes nothing — this step correctly stays silent.
• One step serves both release lines. This workflow runs on main (v9 → latest) and on
  v8 (→ v8 dist-tag), so no branch special-casing. Canary is excluded by the same if:,
  which matters because a canary version string (9.30.0-canary-<datetime>) would exceed the
  endpoint's 20-character limit anyway.

This is inert until the secret is provisioned. Without SDK_RELEASE_SERVICE_CREDS it logs
a warning and exits 0, so it is safe to merge ahead of the credential.

Related Jira task/s

• https://browserstack.atlassian.net/browse/SDK-7358

Release (mandatory for every PR — required for the ready-for-review label)

Version bump: (required — tick exactly one)

• minor (backwards-compatible feature)
• patch (bug fix or other small change)

Release notes type: (optional)

• New Feature
• Bug Fix
• Other Improvement

Release notes (customer-facing): (optional but encouraged)

• None — internal release tooling only.

Release notes (internal): (required — engineer-facing; what actually changed / why)

• Adds id: publish to the existing Publish to npm step so its outputs can be referenced.
• Adds a Record release in the SDK version catalog step that POSTs {language: "ecmascript", version, release_date} to /sdk/v1/admin/releases, gated on steps.publish.outputs.published == 'true'.
• Cannot fail a release: continue-on-error: true, a guard for the missing credential, and a version-format check before the call. 409 (already recorded with a different date) is surfaced as a warning to investigate rather than forced.

Checklist

• Ready to review
• Has it been tested locally?

PR Validations

Run Tests: Comment RUN_TESTS to trigger sanity tests.

Testing

• YAML parsed; step order verified (after Publish to npm, before the canary step) and id=publish confirmed present.
• The paired v8 PR is a clean cherry-pick of this commit, and the resulting release.yml is byte-identical across both lines.
• Not executed against the live endpoint — the credential does not exist yet on either side.

⚠️ Two blockers before this does anything

1. SDK_RELEASE_SERVICE_CREDS secret does not exist in this repo. The Jenkins hook reads the credential from Vault; GitHub runners have no Vault, so it must be provisioned separately as an Actions secret (value: client_id:client_secret).
2. Edge reachability is unconfirmed. railsApp imposes no network restriction on this route, but nobody has verified whether an edge proxy or WAF blocks it from outside BrowserStack's network — and GitHub-hosted runners are external. Cheapest check: a throwaway workflow_dispatch that just prints the HTTP code. A 401/503 is a success for that test; a timeout or WAF page is not.

Pairs with #204 (v9). Suggest enabling v9 first, then this one.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: d0b67983-5fd1-4a8d-9f00-705ea896695d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}