Skip to content

Commit 8dec0c3

Browse files
JulusianJulusian
committed
chore: update publish workflow for trusted publishing
1 parent d33eac3 commit 8dec0c3

File tree

2 files changed

+170
-127
lines changed

2 files changed

+170
-127
lines changed

‎.github/workflows/node.yaml‎

Lines changed: 31 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -2,126 +2,64 @@ name: Node CI
22

33
on:
44
push:
5-
branches:
6-
- '**'
7-
tags:
8-
- 'v[0-9]+.[0-9]+.[0-9]+*'
95
pull_request:
106

117
jobs:
128
lint:
139
name: Lint
1410
runs-on: ubuntu-latest
15-
timeout-minutes: 5
11+
continue-on-error: true
12+
timeout-minutes: 15
1613

1714
steps:
18-
- uses: actions/checkout@v5
15+
- name: Git checkout
16+
uses: actions/checkout@v5
1917
with:
2018
persist-credentials: false
21-
2219
- name: Use Node.js 22.x
23-
uses: actions/setup-node@v4
20+
uses: actions/setup-node@v6
2421
with:
25-
node-version: 22
26-
27-
- name: Prepare environment
22+
node-version: 22.x
23+
- name: Prepare Environment
2824
run: |
29-
corepack enable
30-
yarn
31-
- name: Run linter
32-
run: yarn lint
33-
34-
test:
35-
name: Tests
36-
runs-on: ubuntu-latest
37-
timeout-minutes: 5
38-
39-
steps:
40-
- uses: actions/checkout@v5
41-
with:
42-
persist-credentials: false
43-
44-
- name: Use Node.js 22.x
45-
uses: actions/setup-node@v4
46-
with:
47-
node-version: 22
48-
49-
- name: Prepare environment
25+
yarn install
26+
yarn build
27+
env:
28+
CI: true
29+
- name: Run typecheck and linter
5030
run: |
51-
corepack enable
52-
yarn
53-
- name: Run tests
54-
run: yarn test
31+
yarn lint
32+
env:
33+
CI: true
5534

56-
release:
57-
name: Release
35+
test:
36+
name: Test
5837
runs-on: ubuntu-latest
5938
timeout-minutes: 15
6039

61-
# only run for tags
62-
if: contains(github.ref, 'refs/tags/')
63-
64-
needs:
65-
- validate-dependencies
66-
- lint
67-
- test
40+
strategy:
41+
fail-fast: false
42+
matrix:
43+
node-version: [20.x, 22.x, 24.x]
6844

6945
steps:
70-
- uses: actions/checkout@v5
46+
- name: Git checkout
47+
uses: actions/checkout@v5
7148
with:
72-
fetch-depth: 0
7349
persist-credentials: false
74-
- name: Use Node.js 22.x
75-
uses: actions/setup-node@v4
50+
- name: Use Node.js ${{ matrix.node-version }}
51+
uses: actions/setup-node@v6
7652
with:
77-
node-version: 22.x
78-
- name: Check release is desired
79-
id: do-publish
80-
run: |
81-
corepack enable
82-
83-
if [ -z "${{ secrets.NPM_TOKEN }}" ]; then
84-
echo "No Token"
85-
else
86-
87-
PUBLISHED_VERSION=$(yarn npm info --json . | jq -c '.version' -r)
88-
THIS_VERSION=$(node -p "require('./package.json').version")
89-
# Simple bash helper to comapre version numbers
90-
verlte() {
91-
[ "$1" = "`echo -e "$1\n$2" | sort -V | head -n1`" ]
92-
}
93-
verlt() {
94-
[ "$1" = "$2" ] && return 1 || verlte $1 $2
95-
}
96-
if verlt $PUBLISHED_VERSION $THIS_VERSION
97-
then
98-
echo "Publishing latest"
99-
echo "tag=latest" >> $GITHUB_OUTPUT
100-
else
101-
echo "Publishing hotfix"
102-
echo "tag=hotfix" >> $GITHUB_OUTPUT
103-
fi
104-
105-
fi
106-
- name: Prepare build
107-
if: ${{ steps.do-publish.outputs.tag }}
53+
node-version: ${{ matrix.node-version }}
54+
- name: Prepare Environment
10855
run: |
109-
corepack enable
11056
yarn install
111-
yarn build
11257
env:
11358
CI: true
114-
- name: Publish to NPM
115-
if: ${{ steps.do-publish.outputs.tag }}
59+
- name: Run tests
11660
run: |
117-
yarn config set npmAuthToken $NPM_AUTH_TOKEN
118-
119-
NEW_VERSION=$(node -p "require('./package.json').version")
120-
yarn npm publish --access=public --tag ${{ steps.do-publish.outputs.tag }}
121-
122-
echo "**Published:** $NEW_VERSION" >> $GITHUB_STEP_SUMMARY
61+
yarn unit
12362
env:
124-
NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
12563
CI: true
12664

12765
validate-dependencies:
@@ -132,15 +70,12 @@ jobs:
13270

13371
steps:
13472
- uses: actions/checkout@v5
135-
with:
136-
persist-credentials: false
13773
- name: Use Node.js 22.x
138-
uses: actions/setup-node@v4
74+
uses: actions/setup-node@v6
13975
with:
14076
node-version: 22.x
14177
- name: Prepare Environment
14278
run: |
143-
corepack enable
14479
yarn install
14580
env:
14681
CI: true
@@ -162,15 +97,12 @@ jobs:
16297

16398
steps:
16499
- uses: actions/checkout@v5
165-
with:
166-
persist-credentials: false
167100
- name: Use Node.js 22.x
168-
uses: actions/setup-node@v4
101+
uses: actions/setup-node@v6
169102
with:
170103
node-version: 22.x
171104
- name: Prepare Environment
172105
run: |
173-
corepack enable
174106
yarn install
175107
env:
176108
CI: true

‎.github/workflows/publish.yaml‎

Lines changed: 139 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,59 +1,170 @@
1-
name: Publish prerelease
1+
name: Publish Release
22

33
on:
4-
# Allows you to run this workflow manually from the Actions tab
4+
push:
5+
tags:
6+
- 'v[0-9]+.[0-9]+.[0-9]+*'
57
workflow_dispatch:
68

9+
permissions:
10+
contents: read
11+
12+
concurrency:
13+
group: ${{ github.workflow }}-${{ github.ref }}
14+
cancel-in-progress: true
15+
16+
# This workflow will perform a publish whenever it is triggered
17+
# If you are using a fork, and want to push tags you can disable this workflow in the github ui
718
jobs:
8-
prerelease:
9-
name: Prerelease
19+
test:
20+
name: Test
1021
runs-on: ubuntu-latest
1122
timeout-minutes: 15
1223

24+
strategy:
25+
fail-fast: false
26+
matrix:
27+
node-version: [20.x, 22.x, 24.x]
28+
29+
steps:
30+
- name: Git checkout
31+
uses: actions/checkout@v5
32+
with:
33+
persist-credentials: false
34+
- name: Use Node.js ${{ matrix.node-version }}
35+
uses: actions/setup-node@v6
36+
with:
37+
node-version: ${{ matrix.node-version }}
38+
- name: Prepare Environment
39+
run: |
40+
corepack enable
41+
yarn install
42+
env:
43+
CI: true
44+
- name: Run tests
45+
run: |
46+
yarn unit
47+
env:
48+
CI: true
49+
50+
prepare:
51+
name: Prepare package
52+
runs-on: ubuntu-latest
53+
outputs:
54+
tag: ${{ steps.do-publish.outputs.tag }}
55+
prerelease: ${{ steps.do-publish.outputs.prerelease }}
56+
timeout-minutes: 15
57+
58+
permissions:
59+
contents: write
60+
1361
steps:
1462
- uses: actions/checkout@v5
1563
with:
1664
fetch-depth: 0
1765
persist-credentials: false
1866
- name: Use Node.js 22.x
19-
uses: actions/setup-node@v4
67+
uses: actions/setup-node@v6
2068
with:
2169
node-version: 22.x
22-
- name: Check release is desired
70+
- name: Enable corepack
71+
run: corepack enable
72+
- name: Determine publish info
2373
id: do-publish
2474
run: |
25-
if [ -z "${{ secrets.NPM_TOKEN }}" ]; then
26-
echo "No Token"
27-
elif [[ "${{ github.ref }}" == "refs/heads/master" ]]; then
28-
echo "Publish nightly"
29-
echo "publish=nightly" >> $GITHUB_OUTPUT
75+
# If this run was started manually, choose nightly for main and experimental otherwise.
76+
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
77+
if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
78+
echo "Publishing nightly"
79+
echo "tag=nightly" >> $GITHUB_OUTPUT
80+
else
81+
echo "Publishing experimental"
82+
echo "tag=experimental" >> $GITHUB_OUTPUT
83+
fi
84+
85+
HASH=$(git rev-parse --short HEAD)
86+
TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
87+
PRERELEASE_TAG=nightly-$(echo "${{ github.ref_name }}" | sed -r 's/[^a-z0-9]+/-/gi')
88+
echo "prerelease=${PRERELEASE_TAG}-${TIMESTAMP}-${HASH}" >> $GITHUB_OUTPUT
89+
3090
else
31-
echo "Publish experimental"
32-
echo "publish=experimental" >> $GITHUB_OUTPUT
91+
# Otherwise (push by tag), keep the previous logic: compare published vs package.json
92+
PUBLISHED_VERSION=$(yarn npm info --json . | jq -c '.version' -r)
93+
THIS_VERSION=$(node -p "require('./package.json').version")
94+
# Simple bash helper to compare version numbers
95+
verlte() {
96+
[ "$1" = "`echo -e "$1\n$2" | sort -V | head -n1`" ]
97+
}
98+
verlt() {
99+
[ "$1" = "$2" ] && return 1 || verlte $1 $2
100+
}
101+
if verlt $PUBLISHED_VERSION $THIS_VERSION
102+
then
103+
echo "Publishing latest"
104+
echo "tag=latest" >> $GITHUB_OUTPUT
105+
else
106+
echo "Publishing hotfix"
107+
echo "tag=hotfix" >> $GITHUB_OUTPUT
108+
fi
33109
fi
34-
- name: Prepare Environment
35-
if: ${{ steps.do-publish.outputs.publish }}
110+
- name: Prepare build
36111
run: |
37-
corepack enable
38112
yarn install
113+
114+
# Bump to prerelease version if needed
115+
if [ "${{ steps.do-publish.outputs.prerelease }}" != "" ]; then
116+
OLD_VERSION=$(node -p "require('./package.json').version")
117+
yarn version ${OLD_VERSION}-${{ steps.do-publish.outputs.prerelease }}
118+
fi
119+
120+
yarn build
39121
env:
40122
CI: true
41-
- name: Bump version and build
42-
if: ${{ steps.do-publish.outputs.publish }}
43-
run: |
44-
PRERELEASE_TAG=nightly-$(echo "${{ github.ref_name }}" | sed -r 's/[^a-z0-9]+/-/gi')
45-
yarn release --prerelease $PRERELEASE_TAG
46-
env:
47-
CI: true
123+
124+
- name: Upload release artifact
125+
uses: actions/upload-artifact@v4
126+
with:
127+
name: publish-dist
128+
path: |
129+
dist
130+
package.json
131+
retention-days: 1
132+
if-no-files-found: error
133+
134+
publish:
135+
name: Publish to NPM
136+
needs:
137+
- prepare
138+
- test
139+
runs-on: ubuntu-latest
140+
permissions:
141+
contents: read
142+
id-token: write # scoped for as short as possible, as this gives write access to npm
143+
144+
steps:
145+
- uses: actions/checkout@v5
146+
with:
147+
fetch-depth: 0
148+
persist-credentials: false
149+
- name: Use Node.js 22.x
150+
uses: actions/setup-node@v6
151+
with:
152+
node-version: 22.x
153+
154+
- name: Download release artifact
155+
uses: actions/download-artifact@v5
156+
with:
157+
name: publish-dist
158+
48159
- name: Publish to NPM
49-
if: ${{ steps.do-publish.outputs.publish }}
50160
run: |
51-
yarn config set npmAuthToken $NPM_AUTH_TOKEN
161+
corepack enable
162+
yarn install
52163
53-
NEW_VERSION=$(node -p "require('./package.json').version")
54-
yarn npm publish --access=public --tag "${{ steps.do-publish.outputs.publish }}"
164+
# Publish from the extracted release (build output present)
165+
yarn npm publish --access=public --provenance --tag ${{ needs.prepare.outputs.tag }}
55166
167+
NEW_VERSION=$(node -p "require('./package.json').version")
56168
echo "**Published:** $NEW_VERSION" >> $GITHUB_STEP_SUMMARY
57169
env:
58-
NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
59170
CI: true

0 commit comments

Comments
 (0)