chore: Ensure correct deploy order

.github/actions/internal-promotion/templates/postamble.js

@@ -1,14 +1,3 @@
-// Reset config values back to released
-window.NREUM.loader_config.agentID = '{{{args.appId}}}'
-window.NREUM.loader_config.applicationID = '{{{args.appId}}}'
-window.NREUM.loader_config.licenseKey = '{{{args.licenseKey}}}'
-window.NREUM.info.applicationID = '{{{args.appId}}}'
-window.NREUM.info.licenseKey = '{{{args.licenseKey}}}'
-window.NREUM.init.proxy = {}
-window.NREUM.init.session_replay.enabled = true
-window.NREUM.init.session_trace.enabled = true
-window.NREUM.init.user_actions = { elementAttributes: ['id', 'className', 'tagName', 'type', 'ariaLabel', 'alt', 'title'] }
-
 // Session replay entitlements check
 try {
   var xhr = new XMLHttpRequest()

.github/workflows/deploy-environment.yml

@@ -0,0 +1,209 @@
+# Reusable workflow for deploying Browser Agent to a single NR1 environment
+# Handles: RC asset deployment, promotion, change tracking, and notifications
+
+name: Deploy to Environment
+
+on:
+  workflow_call:
+    inputs:
+      # Core environment identifier
+      nr_environment:
+        description: 'NR environment name (dev, staging, eu-prod, jp-prod, prod)'
+        required: true
+        type: string
+
+      # Deployment source (empty = build fresh RC, populated = use existing version)
+      script_url:
+        description: 'Script URL for existing version (if empty, builds fresh RC from current branch)'
+        required: false
+        type: string
+      version_label:
+        description: 'Version label for existing version (if empty, builds fresh RC from current branch)'
+        required: false
+        type: string
+
+    outputs:
+      version_label:
+        description: 'Version label of the deployed agent'
+        value: ${{ jobs.deploy.outputs.version_label }}
+
+    # All secrets are inherited from the calling workflow
+
+jobs:
+  deploy:
+    # Staging needs whitelisted IP for NRDB upload (auto-detected)
+    runs-on: ${{ inputs.nr_environment == 'staging' && 'Browser-Agent-Assigned-IP-Linux' || 'ubuntu-latest' }}
+    environment: nr1-${{ inputs.nr_environment }}
+    timeout-minutes: 30
+    outputs:
+      version_label: ${{ steps.set-version.outputs.version_label }}
+      region_name: ${{ steps.env-details.outputs.region_name }}
+      env_id: ${{ steps.env-details.outputs.env_id }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.11.0
+
+      # Derive environment details from nr_environment
+      - name: Set environment details
+        id: env-details
+        run: |
+          NR_ENV="${{ inputs.nr_environment }}"
+
+          # Derive env_id (strip nr1- if present, for secret mapping)
+          ENV_ID="${NR_ENV}"
+          echo "env_id=${ENV_ID}" >> $GITHUB_OUTPUT
+
+          # Derive bucket_dir (prod -> prod/, others -> {env}/)
+          if [[ "$NR_ENV" == "prod" ]]; then
+            BUCKET_DIR="prod/"
+          else
+            BUCKET_DIR="${NR_ENV}/"
+          fi
+          echo "bucket_dir=${BUCKET_DIR}" >> $GITHUB_OUTPUT
+
+          # Derive region_name for change tracking
+          case "$NR_ENV" in
+            dev) REGION="Dev" ;;
+            staging) REGION="Staging" ;;
+            eu-prod) REGION="EU" ;;
+            jp-prod) REGION="JP" ;;
+            prod) REGION="US" ;;
+            *) REGION="${NR_ENV}" ;;
+          esac
+          echo "region_name=${REGION}" >> $GITHUB_OUTPUT
+
+          # Derive behavioral flags from environment
+          [[ "$NR_ENV" == "dev" ]] && APPEND_BRANCH="true" || APPEND_BRANCH="false"
+          echo "append_branch_name=${APPEND_BRANCH}" >> $GITHUB_OUTPUT
+
+          [[ "$NR_ENV" == "staging" ]] && UPLOAD_NRDB="true" || UPLOAD_NRDB="false"
+          echo "upload_to_nrdb=${UPLOAD_NRDB}" >> $GITHUB_OUTPUT
+
+          [[ "$NR_ENV" != "dev" ]] && NOTIFY="true" || NOTIFY="false"
+          echo "send_notification=${NOTIFY}" >> $GITHUB_OUTPUT
+
+          echo "🏷️  Environment: ${NR_ENV}, Bucket: ${BUCKET_DIR}, Region: ${REGION}, Branch Suffix: ${APPEND_BRANCH}, NRDB Upload: ${UPLOAD_NRDB}, Notify: ${NOTIFY}"
+
+      # Determine branch name for version suffix (only dev)
+      - name: Determine branch name for version
+        if: steps.env-details.outputs.append_branch_name == 'true'
+        id: branch-name
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            BRANCH="${{ github.head_ref }}"
+          else
+            BRANCH="${{ github.ref_name }}"
+          fi
+
+          # Clean branch name for version suffix (lowercase, replace special chars with hyphens)
+          CLEAN_BRANCH=$(echo "$BRANCH" | sed 's/[^a-zA-Z0-9-]/-/g' | tr '[:upper:]' '[:lower:]')
+          echo "branch_name=${CLEAN_BRANCH}" >> $GITHUB_OUTPUT
+          echo "🏷️  Using branch-specific version suffix: ${CLEAN_BRANCH}"
+
+      # Build and deploy RC assets
+      - name: Deploy RC assets
+        if: inputs.script_url == ''
+        id: deploy-rc
+        uses: ./.github/actions/deploy-rc-assets
+        with:
+          environment: ${{ inputs.nr_environment }}
+          bucket_dir: ${{ steps.env-details.outputs.bucket_dir }}
+          cdn_service: js-agent.newrelic.com
+          branch_name: ${{ steps.env-details.outputs.append_branch_name == 'true' && steps.branch-name.outputs.branch_name || '' }}
+          aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws_role: ${{ steps.env-details.outputs.env_id == 'dev' && secrets.INTERNAL_DEV_APPLICATION_ID || steps.env-details.outputs.env_id == 'staging' && secrets.INTERNAL_STAGING_APPLICATION_ID || steps.env-details.outputs.env_id == 'eu-prod' && secrets.INTERNAL_EU_PRODUCTION_APPLICATION_ID || steps.env-details.outputs.env_id == 'jp-prod' && secrets.INTERNAL_JP_PRODUCTION_APPLICATION_ID || secrets.INTERNAL_PRODUCTION_APPLICATION_ID }}
+          aws_bucket_name: ${{ secrets.AWS_BUCKET }}
+          fastly_key: ${{ secrets.FASTLY_PURGE_KEY }}
+
+      # Promote agent to environment
+      - name: Promote agent to ${{ steps.env-details.outputs.region_name }}
+        uses: ./.github/actions/internal-promotion
+        with:
+          nr_environment: ${{ inputs.nr_environment }}
+          nrba_released_script_url: ${{ inputs.script_url == '' && steps.deploy-rc.outputs.script_url || inputs.script_url }}
+          nrba_app_id: ${{ steps.env-details.outputs.env_id == 'dev' && secrets.INTERNAL_DEV_APPLICATION_ID || steps.env-details.outputs.env_id == 'staging' && secrets.INTERNAL_STAGING_APPLICATION_ID || steps.env-details.outputs.env_id == 'eu-prod' && secrets.INTERNAL_EU_PRODUCTION_APPLICATION_ID || steps.env-details.outputs.env_id == 'jp-prod' && secrets.INTERNAL_JP_PRODUCTION_APPLICATION_ID || secrets.INTERNAL_PRODUCTION_APPLICATION_ID }}
+          nrba_license_key: ${{ secrets.INTERNAL_LICENSE_KEY }}
+          aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws_role: ${{ secrets.AWS_ROLE_ARN }}
+          aws_bucket_name: ${{ secrets.AWS_BUCKET }}
+          fastly_key: ${{ secrets.FASTLY_PURGE_KEY }}
+
+      # Build versioned loaders for NRDB copy+paste (staging only)
+      - name: Build versioned loaders for NRDB copy+paste
+        if: steps.env-details.outputs.upload_to_nrdb == 'true' && inputs.script_url == ''
+        run: |
+          echo "🔨 Building prod loaders with versioned filenames for NRDB upload"
+          npm run cdn:webpack -- --env mode=prod
+
+      # Update copy-paste loader in NRDB (staging only)
+      - name: Update copy-paste loader in NRDB
+        if: steps.env-details.outputs.upload_to_nrdb == 'true' && inputs.script_url == ''
+        continue-on-error: true
+        env:
+          STAGE_API_KEY: ${{ secrets.NR_API_KEY_STAGING }}
+        run: |
+          LOADER_VERSION=$(jq -r '.version' package.json)
+          npm --prefix .github/actions install
+          node .github/actions/nr-upload/index.js \
+            --environment=stage \
+            --loader-version=$LOADER_VERSION \
+            --stage-api-key=$STAGE_API_KEY \
+            --local-dir=./build
+          node .github/actions/nr-verify/index.js \
+            --loader-version=$LOADER_VERSION
+
+      # Set version label output
+      - name: Set version label
+        id: set-version
+        run: |
+          # Use RC-generated version if building fresh, otherwise use provided version
+          if [[ -z "${{ inputs.script_url }}" ]]; then
+            VERSION="${{ steps.deploy-rc.outputs.version_label }}"
+          else
+            VERSION="${{ inputs.version_label }}"
+          fi
+          echo "version_label=${VERSION}" >> $GITHUB_OUTPUT
+
+  # Create change tracking event
+  change-tracking:
+    needs: [deploy]
+    runs-on: Browser-Agent-Assigned-IP-Linux
+    environment: change-tracking
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Create ${{ needs.deploy.outputs.region_name }} change tracking event
+        uses: ./.github/actions/change-tracking
+        with:
+          accountId: '1067061'
+          entityGuid: ${{ needs.deploy.outputs.env_id == 'dev' && secrets.NR_ENTITY_GUID_NR1_DEV || needs.deploy.outputs.env_id == 'staging' && secrets.NR_ENTITY_GUID_NR1_STAGING || needs.deploy.outputs.env_id == 'eu-prod' && secrets.NR_ENTITY_GUID_NR1_EU_PROD || needs.deploy.outputs.env_id == 'jp-prod' && secrets.NR_ENTITY_GUID_NR1_JP_PROD || secrets.NR_ENTITY_GUID_NR1_US_PROD }}
+          apiKey: ${{ secrets.NR_CHANGE_TRACKING_API_KEY_NR1 }}
+          region: ${{ needs.deploy.outputs.region_name }}
+          version: ${{ needs.deploy.outputs.version_label }}
+          type: Rolling
+          description: '${{ needs.deploy.outputs.region_name }} promoted to ${{ needs.deploy.outputs.version_label }}'
+          shortDescription: '${{ needs.deploy.outputs.region_name }}: ${{ needs.deploy.outputs.version_label }}'
+          deepLink: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+          commit: ${{ github.sha }}
+          user: ${{ github.actor }}
+          groupId: '${{ github.run_id }}-${{ github.sha }}'
+
+  # Send Slack notification
+  notify:
+    if: needs.deploy.outputs.env_id != 'dev'
+    needs: [deploy]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Send Slack notification
+        uses: ./.github/actions/slack-notification
+        with:
+          notifications_channel_url: ${{ secrets.SLACK_BROWSER_AGENT_NOTIFICATIONS_WEBHOOK_URL }}
+          dem_platform_ops_channel_url: ${{ secrets.SLACK_DEM_PLATFORM_OPS_WEBHOOK_URL }}
+          message: ":rocket: New Browser Agent version promoted to \\`${{ needs.deploy.outputs.region_name }}\\` environment.  See <https://github.com/newrelic/newrelic-browser-agent/actions/runs/${{ github.run_id }}|workflow run>."