web3gbit-cli 1.0.0

package/lib/openzeppelin-contracts/scripts/generate/templates/TransientSlot.js

@@ -0,0 +1,80 @@
+const format = require('../format-lines');
+const { TYPES } = require('./Slot.opts');
+
+const header = `\
+pragma solidity ^0.8.24;
+
+/**
+ * @dev Library for reading and writing value-types to specific transient storage slots.
+ *
+ * Transient slots are often used to store temporary values that are removed after the current transaction.
+ * This library helps with reading and writing to such slots without the need for inline assembly.
+ *
+ *  * Example reading and writing values using transient storage:
+ * \`\`\`solidity
+ * contract Lock {
+ *     using TransientSlot for *;
+ *
+ *     // Define the slot. Alternatively, use the SlotDerivation library to derive the slot.
+ *     bytes32 internal constant _LOCK_SLOT = 0xf4678858b2b588224636b8522b729e7722d32fc491da849ed75b3fdf3c84f542;
+ *
+ *     modifier locked() {
+ *         require(!_LOCK_SLOT.asBoolean().tload());
+ *
+ *         _LOCK_SLOT.asBoolean().tstore(true);
+ *         _;
+ *         _LOCK_SLOT.asBoolean().tstore(false);
+ *     }
+ * }
+ * \`\`\`
+ *
+ * TIP: Consider using this library along with {SlotDerivation}.
+ */
+`;
+
+const udvt = ({ type, name }) => `\
+/**
+ * @dev UDVT that represents a slot holding ${type == 'address' ? 'an' : 'a'} ${type}.
+ */
+type ${name}Slot is bytes32;
+
+/**
+ * @dev Cast an arbitrary slot to a ${name}Slot.
+ */
+function as${name}(bytes32 slot) internal pure returns (${name}Slot) {
+    return ${name}Slot.wrap(slot);
+}
+`;
+
+const transient = ({ type, name }) => `\
+/**
+ * @dev Load the value held at location \`slot\` in transient storage.
+ */
+function tload(${name}Slot slot) internal view returns (${type} value) {
+    assembly ("memory-safe") {
+        value := tload(slot)
+    }
+}
+
+/**
+ * @dev Store \`value\` at location \`slot\` in transient storage.
+ */
+function tstore(${name}Slot slot, ${type} value) internal {
+    assembly ("memory-safe") {
+        tstore(slot, value)
+    }
+}
+`;
+
+// GENERATE
+module.exports = format(
+  header.trimEnd(),
+  'library TransientSlot {',
+  format(
+    [].concat(
+      TYPES.filter(type => type.isValueType).map(type => udvt(type)),
+      TYPES.filter(type => type.isValueType).map(type => transient(type)),
+    ),
+  ).trimEnd(),
+  '}',
+);

package/lib/openzeppelin-contracts/scripts/generate/templates/TransientSlotMock.js

@@ -0,0 +1,35 @@
+const format = require('../format-lines');
+const { TYPES } = require('./Slot.opts');
+
+const header = `\
+pragma solidity ^0.8.24;
+
+import {Multicall} from "../utils/Multicall.sol";
+import {TransientSlot} from "../utils/TransientSlot.sol";
+`;
+
+const transient = ({ type, name }) => `\
+event ${name}Value(bytes32 slot, ${type} value);
+
+function tload${name}(bytes32 slot) public {
+    emit ${name}Value(slot, slot.as${name}().tload());
+}
+
+function tstore(bytes32 slot, ${type} value) public {
+    slot.as${name}().tstore(value);
+}
+`;
+
+// GENERATE
+module.exports = format(
+  header,
+  'contract TransientSlotMock is Multicall {',
+  format(
+    [].concat(
+      'using TransientSlot for *;',
+      '',
+      TYPES.filter(type => type.isValueType).map(type => transient(type)),
+    ),
+  ).trimEnd(),
+  '}',
+);

package/lib/openzeppelin-contracts/scripts/generate/templates/conversion.js

@@ -0,0 +1,34 @@
+function toBytes32(type, value) {
+  switch (type) {
+    case 'bytes32':
+      return value;
+    case 'bytes4':
+      return `bytes32(${value})`;
+    case 'uint256':
+      return `bytes32(${value})`;
+    case 'address':
+      return `bytes32(uint256(uint160(${value})))`;
+    default:
+      throw new Error(`Conversion from ${type} to bytes32 not supported`);
+  }
+}
+
+function fromBytes32(type, value) {
+  switch (type) {
+    case 'bytes32':
+      return value;
+    case 'bytes4':
+      return `bytes4(${value})`;
+    case 'uint256':
+      return `uint256(${value})`;
+    case 'address':
+      return `address(uint160(uint256(${value})))`;
+    default:
+      throw new Error(`Conversion from bytes32 to ${type} not supported`);
+  }
+}
+
+module.exports = {
+  toBytes32,
+  fromBytes32,
+};

package/lib/openzeppelin-contracts/scripts/get-contracts-metadata.js

@@ -0,0 +1,55 @@
+const fs = require('fs');
+const glob = require('glob');
+const match = require('micromatch');
+const path = require('path');
+const { findAll } = require('solidity-ast/utils');
+
+module.exports = function (
+  pattern = 'contracts/**/*.sol',
+  skipPatterns = ['contracts/mocks/**/*.sol'],
+  artifacts = [],
+) {
+  // Use available hardhat artifacts. They reliably identify pragmas and the contracts, libraries and interfaces
+  // definitions with minimal IO operations.
+  const metadata = Object.fromEntries(
+    artifacts.flatMap(artifact => {
+      const { output: solcOutput } = require(path.resolve(__dirname, '..', artifact));
+      return Object.keys(solcOutput.contracts)
+        .filter(source => match.all(source, pattern) && !match.any(source, skipPatterns))
+        .map(source => [
+          source,
+          {
+            pragma: Array.from(findAll('PragmaDirective', solcOutput.sources[source].ast))
+              .find(({ literals }) => literals.at(0) == 'solidity')
+              .literals.slice(1)
+              .join(''),
+            sources: Array.from(findAll('ImportDirective', solcOutput.sources[source].ast)).map(
+              ({ absolutePath }) => absolutePath,
+            ),
+            interface: Array.from(findAll('ContractDefinition', solcOutput.sources[source].ast)).every(
+              ({ contractKind }) => contractKind === 'interface',
+            ),
+          },
+        ]);
+    }),
+  );
+
+  // Artifacts are missing files that only include imports. We have a few of these in contracts/interfaces
+  // We add the missing metadata entries using the foundry artifacts
+  glob
+    .sync(pattern)
+    .filter(file => !match.any(file, skipPatterns) && !Object.hasOwn(metadata, file))
+    .forEach(file => {
+      const entries = glob.sync(`out/${path.basename(file)}/*`);
+      metadata[file] = {
+        pragma: fs.readFileSync(file, 'utf-8').match(/pragma solidity (?<pragma>[<>=^]*[0-9]+\.[0-9]+\.[0-9]+);/)
+          ?.groups.pragma,
+        sources: entries
+          .flatMap(entry => Object.keys(JSON.parse(fs.readFileSync(entry)).metadata.sources))
+          .filter(source => source !== file && match.all(source, pattern) && !match.any(source, skipPatterns)),
+        interface: entries.every(entry => path.basename(entry).match(/^I[A-Z]/)),
+      };
+    });
+
+  return metadata;
+};

package/lib/openzeppelin-contracts/scripts/git-user-config.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -euo pipefail -x
+
+git config user.name 'github-actions'
+git config user.email '41898282+github-actions[bot]@users.noreply.github.com'

package/lib/openzeppelin-contracts/scripts/helpers.js

@@ -0,0 +1,7 @@
+const iterate = require('../test/helpers/iterate');
+const strings = require('../test/helpers/strings');
+
+module.exports = {
+  ...iterate,
+  ...strings,
+};

package/lib/openzeppelin-contracts/scripts/minimize-pragma.js

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const graphlib = require('graphlib');
+const semver = require('semver');
+const pLimit = require('p-limit').default;
+const { hideBin } = require('yargs/helpers');
+const yargs = require('yargs/yargs');
+
+const getContractsMetadata = require('./get-contracts-metadata');
+const { versions: allSolcVersions, compile } = require('./solc-versions');
+
+const {
+  argv: { pattern, skipPatterns, minVersionForContracts, minVersionForInterfaces, concurrency, _: artifacts },
+} = yargs(hideBin(process.argv))
+  .env('')
+  .options({
+    pattern: { alias: 'p', type: 'string', default: 'contracts/**/*.sol' },
+    skipPatterns: { alias: 's', type: 'string', default: 'contracts/mocks/**/*.sol' },
+    minVersionForContracts: { type: 'string', default: '0.8.20' },
+    minVersionForInterfaces: { type: 'string', default: '0.0.0' },
+    concurrency: { alias: 'c', type: 'number', default: 8 },
+  });
+
+// limit concurrency
+const limit = pLimit(concurrency);
+
+/********************************************************************************************************************
+ *                                                     HELPERS                                                      *
+ ********************************************************************************************************************/
+
+/**
+ * Updates the pragma in the given file to the newPragma version.
+ * @param {*} file Absolute path to the file to update.
+ * @param {*} pragma New pragma version to set. (ex: '>=0.8.4')
+ */
+const updatePragma = (file, pragma) =>
+  fs.writeFileSync(
+    file,
+    fs
+      .readFileSync(file, 'utf8')
+      .replace(/pragma solidity [><=^]*[0-9]+\.[0-9]+\.[0-9]+;/, `pragma solidity ${pragma};`),
+    'utf8',
+  );
+
+/**
+ * Get the applicable pragmas for a given file by compiling it with all solc versions.
+ * @param {*} file Absolute path to the file to compile.
+ * @param {*} candidates List of solc version to test. (ex: ['0.8.4','0.8.5'])
+ * @returns {Promise<string[]>} List of applicable pragmas.
+ */
+const getApplicablePragmas = (file, candidates = allSolcVersions) =>
+  Promise.all(
+    candidates.map(version =>
+      limit(() =>
+        compile(file, version).then(
+          () => version,
+          () => null,
+        ),
+      ),
+    ),
+  ).then(versions => versions.filter(Boolean));
+
+/**
+ * Get the minimum applicable pragmas for a given file.
+ * @param {*} file Absolute path to the file to compile.
+ * @param {*} candidates List of solc version to test. (ex: ['0.8.4','0.8.5'])
+ * @returns {Promise<string>} Smallest applicable pragma out of the list.
+ */
+const getMinimalApplicablePragma = (file, candidates = allSolcVersions) =>
+  getApplicablePragmas(file, candidates).then(valid => {
+    if (valid.length == 0) {
+      throw new Error(`No valid pragma found for ${file}`);
+    } else {
+      return valid.sort(semver.compare).at(0);
+    }
+  });
+
+/**
+ * Get the minimum applicable pragmas for a given file, and update the file to use it.
+ * @param {*} file Absolute path to the file to compile.
+ * @param {*} candidates List of solc version to test. (ex: ['0.8.4','0.8.5'])
+ * @param {*} prefix Prefix to use when building the pragma (ex: '^')
+ * @returns {Promise<string>} Version that was used and set in the file
+ */
+const setMinimalApplicablePragma = (file, candidates = allSolcVersions, prefix = '>=') =>
+  getMinimalApplicablePragma(file, candidates)
+    .then(version => `${prefix}${version}`)
+    .then(pragma => {
+      updatePragma(file, pragma);
+      return pragma;
+    });
+
+/********************************************************************************************************************
+ *                                                       MAIN                                                       *
+ ********************************************************************************************************************/
+
+// Build metadata from artifact files (hardhat compilation)
+const metadata = getContractsMetadata(pattern, skipPatterns, artifacts);
+
+// Build dependency graph
+const graph = new graphlib.Graph({ directed: true });
+Object.keys(metadata).forEach(file => {
+  graph.setNode(file);
+  metadata[file].sources.forEach(dep => graph.setEdge(dep, file));
+});
+
+// Weaken all pragma to allow exploration
+Object.keys(metadata).forEach(file => updatePragma(file, '>=0.0.0'));
+
+// Do a topological traversal of the dependency graph, minimizing pragma for each file we encounter
+(async () => {
+  const queue = graph.sources();
+  const pragmas = {};
+  while (queue.length) {
+    const file = queue.shift();
+    if (!Object.hasOwn(pragmas, file)) {
+      if (Object.hasOwn(metadata, file)) {
+        const minVersion = metadata[file].interface ? minVersionForInterfaces : minVersionForContracts;
+        const parentsPragmas = graph
+          .predecessors(file)
+          .map(file => pragmas[file])
+          .filter(Boolean);
+        const candidates = allSolcVersions.filter(
+          v => semver.gte(v, minVersion) && parentsPragmas.every(p => semver.satisfies(v, p)),
+        );
+        const pragmaPrefix = metadata[file].interface ? '>=' : '^';
+
+        process.stdout.write(
+          `[${Object.keys(pragmas).length + 1}/${Object.keys(metadata).length}] Searching minimal version for ${file} ... `,
+        );
+        const pragma = await setMinimalApplicablePragma(file, candidates, pragmaPrefix);
+        console.log(pragma);
+
+        pragmas[file] = pragma;
+      }
+      queue.push(...graph.successors(file));
+    }
+  }
+})();

package/lib/openzeppelin-contracts/scripts/prepack.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+shopt -s globstar
+
+# cross platform `mkdir -p`
+mkdirp() {
+  node -e "fs.mkdirSync('$1', { recursive: true })"
+}
+
+# cd to the root of the repo
+cd "$(git rev-parse --show-toplevel)"
+
+npm run clean
+
+env COMPILE_MODE=production npm run compile
+
+mkdirp contracts/build/contracts
+cp artifacts/contracts/**/*.json contracts/build/contracts
+rm contracts/build/contracts/*.dbg.json
+node scripts/remove-ignored-artifacts.js
+
+cp README.md contracts/

package/lib/openzeppelin-contracts/scripts/prepare-docs.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+shopt -s globstar
+
+OUTDIR="$(node -p 'require("./docs/config.js").outputDir')"
+
+if [ ! -d node_modules ]; then
+  npm ci
+fi
+
+rm -rf "$OUTDIR"
+
+hardhat docgen
+
+# copy examples and adjust imports
+examples_source_dir="contracts/mocks/docs"
+examples_target_dir="docs/modules/api/examples"
+
+for f in "$examples_source_dir"/**/*.sol; do
+  name="${f/#"$examples_source_dir"/}"
+  mkdir -p "$examples_target_dir/$(dirname "$name")"
+  sed -Ee '/^import/s|"(\.\./)+|"@openzeppelin/contracts/|' "$f" > "$examples_target_dir/$name"
+done
+
+node scripts/gen-nav.js "$OUTDIR" > "$OUTDIR/../nav.adoc"

package/lib/openzeppelin-contracts/scripts/release/format-changelog.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+
+// Adjusts the format of the changelog that changesets generates.
+// This is run automatically when npm version is run.
+
+const fs = require('fs');
+const changelog = fs.readFileSync('CHANGELOG.md', 'utf8');
+
+// Groups:
+//  - 1: Pull Request Number and URL
+//  - 2: Changeset entry
+const RELEASE_LINE_REGEX = /^- (\[#.*?\]\(.*?\))?.*?! - (.*)$/gm;
+
+// Captures vX.Y.Z or vX.Y.Z-rc.W
+const VERSION_TITLE_REGEX = /^## (\d+\.\d+\.\d+(-rc\.\d+)?)$/gm;
+
+const isPrerelease = process.env.PRERELEASE === 'true';
+
+const formatted = changelog
+  // Remove titles
+  .replace(/^### Major Changes\n\n/gm, '')
+  .replace(/^### Minor Changes\n\n/gm, '')
+  .replace(/^### Patch Changes\n\n/gm, '')
+  // Remove extra whitespace between items
+  .replace(/^(- \[.*\n)\n(?=-)/gm, '$1')
+  // Format each release line
+  .replace(RELEASE_LINE_REGEX, (_, pr, entry) => (pr ? `- ${entry} (${pr})` : `- ${entry}`))
+  // Add date to new version
+  .replace(VERSION_TITLE_REGEX, `\n## $1 (${new Date().toISOString().split('T')[0]})`)
+  // Conditionally allow vX.Y.Z-rc.W sections only in prerelease
+  .replace(/^## \d\.\d\.\d-rc\S+[^]+?(?=^#)/gm, section => (isPrerelease ? section : ''));
+
+fs.writeFileSync('CHANGELOG.md', formatted);

package/lib/openzeppelin-contracts/scripts/release/synchronize-versions.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+
+// Synchronizes the version in contracts/package.json with the one in package.json.
+// This is run automatically when npm version is run.
+
+const fs = require('fs');
+
+setVersion('package.json', 'contracts/package.json');
+
+function setVersion(from, to) {
+  const fromJson = JSON.parse(fs.readFileSync(from));
+  const toJson = JSON.parse(fs.readFileSync(to));
+  toJson.version = fromJson.version;
+  fs.writeFileSync(to, JSON.stringify(toJson, null, 2) + '\n');
+}

package/lib/openzeppelin-contracts/scripts/release/update-comment.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const proc = require('child_process');
+const semver = require('semver');
+const run = (cmd, ...args) => proc.execFileSync(cmd, args, { encoding: 'utf8' }).trim();
+
+const gitStatus = run('git', 'status', '--porcelain', '-uno', 'contracts/**/*.sol');
+if (gitStatus.length > 0) {
+  console.error('Contracts directory is not clean');
+  process.exit(1);
+}
+
+const { version } = require('../../package.json');
+
+// Get latest tag according to semver.
+const [tag] = run('git', 'tag')
+  .split(/\r?\n/)
+  .filter(semver.coerce) // check version can be processed
+  .filter(v => semver.satisfies(v, `< ${version}`)) // ignores prereleases unless currently a prerelease
+  .sort(semver.rcompare);
+
+// Ordering tag → HEAD is important here.
+const files = run('git', 'diff', tag, 'HEAD', '--name-only', 'contracts/**/*.sol')
+  .split(/\r?\n/)
+  .filter(file => file && !file.match(/mock/i) && fs.existsSync(file));
+
+for (const file of files) {
+  const current = fs.readFileSync(file, 'utf8');
+  const updated = current.replace(
+    /(\/\/ SPDX-License-Identifier:.*)$(\n\/\/ OpenZeppelin Contracts .*$)?/m,
+    `$1\n// OpenZeppelin Contracts (last updated v${version}) (${file.replace('contracts/', '')})`,
+  );
+  fs.writeFileSync(file, updated);
+}

package/lib/openzeppelin-contracts/scripts/release/version.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+changeset version
+
+scripts/release/format-changelog.js
+scripts/release/synchronize-versions.js
+scripts/release/update-comment.js
+
+oz-docs update-version

package/lib/openzeppelin-contracts/scripts/release/workflow/check-upgradeable.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Get commit hash (short) of the reference commit (non-upgradeable version)
+cd lib/openzeppelin-contracts
+REFERENCE_COMMIT="$(git rev-parse --short HEAD)"
+
+# Check that the commit message of the local commit (upgradeable version) matches the reference commit
+cd ../..
+if ! git log -1 --pretty=%B | grep -q "Transpile ${REFERENCE_COMMIT}"; then
+  echo "Expected 'Transpile ${REFERENCE_COMMIT}' but found '$(git log -1 --pretty=%B)'"
+  exit 1
+fi
+
+# Read the version from the package.json, and check whether that corresponds to a pre-release
+VERSION="$(jq -r .version contracts/package.json)"
+if [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  PRERELEASE="false"
+elif [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$ ]]; then
+  PRERELEASE="true"
+else
+  echo "Invalid version"
+  exit 1
+fi
+
+echo "is_prerelease=${PRERELEASE}" >> "$GITHUB_OUTPUT"

package/lib/openzeppelin-contracts/scripts/release/workflow/exit-prerelease.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+npx changeset pre exit rc
+git add .
+git commit -m "Exit release candidate"
+git push origin

package/lib/openzeppelin-contracts/scripts/release/workflow/github-release.js

@@ -0,0 +1,48 @@
+const { readFileSync } = require('fs');
+const { join } = require('path');
+const { version } = require(join(__dirname, '../../../package.json'));
+
+module.exports = async ({ github, context }) => {
+  const changelog = readFileSync('CHANGELOG.md', 'utf8');
+
+  await github.rest.repos.createRelease({
+    owner: context.repo.owner,
+    repo: context.repo.repo + (process.env.REPO_SUFFIX ?? ''),
+    tag_name: `v${version}`,
+    target_commitish: process.env.TARGET_COMMIT ?? context.sha,
+    body: extractSection(changelog, version),
+    prerelease: process.env.PRERELEASE === 'true',
+  });
+};
+
+// From https://github.com/frangio/extract-changelog/blob/master/src/utils/word-regexp.ts
+function makeWordRegExp(word) {
+  const start = word.length > 0 && /\b/.test(word[0]) ? '\\b' : '';
+  const end = word.length > 0 && /\b/.test(word[word.length - 1]) ? '\\b' : '';
+  return new RegExp(start + [...word].map(c => (/[a-z0-9]/i.test(c) ? c : '\\' + c)).join('') + end);
+}
+
+// From https://github.com/frangio/extract-changelog/blob/master/src/core.ts
+function extractSection(document, wantedHeading) {
+  // ATX Headings as defined in GitHub Flavored Markdown (https://github.github.com/gfm/#atx-headings)
+  const heading = /^ {0,3}(?<lead>#{1,6})(?: [ \t\v\f]*(?<text>.*?)[ \t\v\f]*)?(?:[\n\r]+|$)/gm;
+
+  const wantedHeadingRe = makeWordRegExp(wantedHeading);
+
+  let start, end;
+
+  for (const m of document.matchAll(heading)) {
+    if (!start) {
+      if (m.groups.text.search(wantedHeadingRe) === 0) {
+        start = m;
+      }
+    } else if (m.groups.lead.length <= start.groups.lead.length) {
+      end = m;
+      break;
+    }
+  }
+
+  if (start) {
+    return document.slice(start.index + start[0].length, end?.index);
+  }
+}

package/lib/openzeppelin-contracts/scripts/release/workflow/integrity-check.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+CHECKSUMS="$RUNNER_TEMP/checksums.txt"
+
+# Extract tarball content into a tmp directory
+tar xf "$TARBALL" -C "$RUNNER_TEMP"
+
+# Move to extracted directory
+cd "$RUNNER_TEMP/package"
+
+# Checksum all Solidity files
+find . -type f -name "*.sol" | xargs shasum > "$CHECKSUMS"
+
+# Back to directory with git contents
+cd "$GITHUB_WORKSPACE/contracts"
+
+# Check against tarball contents
+shasum -c "$CHECKSUMS"

package/lib/openzeppelin-contracts/scripts/release/workflow/pack.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+dist_tag() {
+  PACKAGE_JSON_NAME="$(jq -r .name ./package.json)"
+  LATEST_NPM_VERSION="$(npm info "$PACKAGE_JSON_NAME" version)"
+  PACKAGE_JSON_VERSION="$(jq -r .version ./package.json)"
+  
+  if [ "$PRERELEASE" = "true" ]; then
+    echo "next"
+  elif npx semver -r ">$LATEST_NPM_VERSION" "$PACKAGE_JSON_VERSION" > /dev/null; then
+    echo "dev"
+  else
+    # This is a patch for an older version
+    # npm can't publish without a tag
+    echo "tmp"
+  fi
+}
+
+cd contracts
+TARBALL="$(npm pack | tee /dev/stderr | tail -1)"
+echo "tarball_name=$TARBALL" >> $GITHUB_OUTPUT
+echo "tarball=$(pwd)/$TARBALL" >> $GITHUB_OUTPUT
+echo "tag=$(dist_tag)" >> $GITHUB_OUTPUT
+cd ..

package/lib/openzeppelin-contracts/scripts/release/workflow/publish.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+PACKAGE_JSON_NAME="$(tar xfO "$TARBALL" package/package.json | jq -r .name)"
+PACKAGE_JSON_VERSION="$(tar xfO "$TARBALL" package/package.json | jq -r .version)"
+
+# Intentionally escape $ to avoid interpolation and writing the token to disk
+echo "//registry.npmjs.org/:_authToken=\${NPM_TOKEN}" > .npmrc
+
+# Actual publish
+npm publish "$TARBALL" --tag "$TAG"
+
+# Clean up tags
+delete_tag() {
+  npm dist-tag rm "$PACKAGE_JSON_NAME" "$1"
+}
+
+if [ "$TAG" = tmp ]; then
+  delete_tag "$TAG"
+elif [ "$TAG" = latest ]; then
+  # Delete the next tag if it exists and is a prerelease for what is currently being published
+  if npm dist-tag ls "$PACKAGE_JSON_NAME" | grep -q "next: $PACKAGE_JSON_VERSION"; then
+    delete_tag next
+  fi
+fi