Skip to content

Commit 799383c

Browse files
JulusianJulusian
committed
chore: update publish workflow for trusted publishing
1 parent bdaf217 commit 799383c

File tree

2 files changed

+147
-110
lines changed

2 files changed

+147
-110
lines changed

‎.github/workflows/node.yaml‎

Lines changed: 21 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,6 @@ name: Node CI
22

33
on:
44
push:
5-
branches:
6-
- '**'
7-
tags:
8-
- 'v[0-9]+.[0-9]+.[0-9]+*'
95
pull_request:
106

117
jobs:
@@ -16,9 +12,12 @@ jobs:
1612
timeout-minutes: 15
1713

1814
steps:
19-
- uses: actions/checkout@v3
15+
- name: Git checkout
16+
uses: actions/checkout@v5
17+
with:
18+
persist-credentials: false
2019
- name: Use Node.js 18.x
21-
uses: actions/setup-node@v3
20+
uses: actions/setup-node@v6
2221
with:
2322
node-version: 18.x
2423
- name: Prepare Environment
@@ -41,12 +40,15 @@ jobs:
4140
strategy:
4241
fail-fast: false
4342
matrix:
44-
node-version: [14.x, 16.x, 18.x, 20.x]
43+
node-version: [14.x, 16.x, 18.x, 20.x, 22.x, 24.x]
4544

4645
steps:
47-
- uses: actions/checkout@v3
46+
- name: Git checkout
47+
uses: actions/checkout@v5
48+
with:
49+
persist-credentials: false
4850
- name: Use Node.js ${{ matrix.node-version }}
49-
uses: actions/setup-node@v3
51+
uses: actions/setup-node@v6
5052
with:
5153
node-version: ${{ matrix.node-version }}
5254
- name: Prepare Environment
@@ -60,73 +62,15 @@ jobs:
6062
env:
6163
CI: true
6264
- name: Send coverage
63-
if: matrix.node-version == '18.x'
64-
uses: codecov/codecov-action@v3
65-
66-
release:
67-
name: Release
68-
runs-on: ubuntu-latest
69-
timeout-minutes: 15
70-
71-
# only run for tags
72-
if: contains(github.ref, 'refs/tags/')
73-
74-
needs:
75-
- test
76-
- validate-dependencies
77-
78-
steps:
79-
- uses: actions/checkout@v3
80-
with:
81-
fetch-depth: 0
82-
- name: Use Node.js 18.x
83-
uses: actions/setup-node@v3
84-
with:
85-
node-version: 18.x
86-
- name: Check release is desired
87-
id: do-publish
88-
run: |
89-
if [ -z "${{ secrets.NPM_TOKEN }}" ]; then
90-
echo "No Token"
91-
else
92-
93-
PUBLISHED_VERSION=$(yarn npm info --json . | jq -c '.version' -r)
94-
THIS_VERSION=$(node -p "require('./package.json').version")
95-
# Simple bash helper to comapre version numbers
96-
verlte() {
97-
[ "$1" = "`echo -e "$1\n$2" | sort -V | head -n1`" ]
98-
}
99-
verlt() {
100-
[ "$1" = "$2" ] && return 1 || verlte $1 $2
101-
}
102-
if verlt $PUBLISHED_VERSION $THIS_VERSION
103-
then
104-
echo "Publishing latest"
105-
echo "tag=latest" >> $GITHUB_OUTPUT
106-
else
107-
echo "Publishing hotfix"
108-
echo "tag=hotfix" >> $GITHUB_OUTPUT
109-
fi
110-
111-
fi
112-
- name: Prepare build
113-
if: ${{ steps.do-publish.outputs.tag }}
114-
run: |
115-
yarn install
116-
yarn build
65+
uses: codecov/codecov-action@v5
11766
env:
118-
CI: true
119-
- name: Publish to NPM
120-
if: ${{ steps.do-publish.outputs.tag }}
67+
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
68+
if: matrix.node-version == '18.x'
69+
- name: Check docs generation
70+
if: matrix.node-version == '18.x'
12171
run: |
122-
yarn config set npmAuthToken $NPM_AUTH_TOKEN
123-
124-
NEW_VERSION=$(node -p "require('./package.json').version")
125-
yarn npm publish --access=public --tag ${{ steps.do-publish.outputs.tag }}
126-
127-
echo "**Published:** $NEW_VERSION" >> $GITHUB_STEP_SUMMARY
72+
yarn docs:test
12873
env:
129-
NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
13074
CI: true
13175

13276
validate-dependencies:
@@ -136,9 +80,9 @@ jobs:
13680
timeout-minutes: 15
13781

13882
steps:
139-
- uses: actions/checkout@v3
83+
- uses: actions/checkout@v5
14084
- name: Use Node.js 18.x
141-
uses: actions/setup-node@v3
85+
uses: actions/setup-node@v6
14286
with:
14387
node-version: 18.x
14488
- name: Prepare Environment
@@ -163,9 +107,9 @@ jobs:
163107
timeout-minutes: 15
164108

165109
steps:
166-
- uses: actions/checkout@v3
110+
- uses: actions/checkout@v5
167111
- name: Use Node.js 18.x
168-
uses: actions/setup-node@v3
112+
uses: actions/setup-node@v6
169113
with:
170114
node-version: 18.x
171115
- name: Prepare Environment

‎.github/workflows/publish.yaml‎

Lines changed: 126 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,20 @@
1-
name: Publish prerelease
1+
name: Publish Release
22

33
on:
4-
# Allows you to run this workflow manually from the Actions tab
4+
push:
5+
tags:
6+
- 'v[0-9]+.[0-9]+.[0-9]+*'
57
workflow_dispatch:
68

9+
permissions:
10+
contents: read
11+
12+
concurrency:
13+
group: ${{ github.workflow }}-${{ github.ref }}
14+
cancel-in-progress: true
15+
16+
# This workflow will perform a publish whenever it is triggered
17+
# If you are using a fork, and want to push tags you can disable this workflow in the github ui
718
jobs:
819
test:
920
name: Test
@@ -13,16 +24,20 @@ jobs:
1324
strategy:
1425
fail-fast: false
1526
matrix:
16-
node-version: [14.x, 16.x, 18.x, 20.x]
27+
node-version: [14.x, 16.x, 18.x, 20.x, 22.x, 24.x]
1728

1829
steps:
19-
- uses: actions/checkout@v3
30+
- name: Git checkout
31+
uses: actions/checkout@v5
32+
with:
33+
persist-credentials: false
2034
- name: Use Node.js ${{ matrix.node-version }}
21-
uses: actions/setup-node@v3
35+
uses: actions/setup-node@v6
2236
with:
2337
node-version: ${{ matrix.node-version }}
2438
- name: Prepare Environment
2539
run: |
40+
corepack enable
2641
yarn install
2742
env:
2843
CI: true
@@ -32,57 +47,135 @@ jobs:
3247
env:
3348
CI: true
3449

35-
prerelease:
36-
name: Prerelease
50+
prepare:
51+
name: Prepare package
3752
runs-on: ubuntu-latest
53+
outputs:
54+
tag: ${{ steps.do-publish.outputs.tag }}
55+
prerelease: ${{ steps.do-publish.outputs.prerelease }}
3856
timeout-minutes: 15
3957

40-
needs:
41-
- test
58+
permissions:
59+
contents: write
4260

4361
steps:
44-
- uses: actions/checkout@v3
62+
- uses: actions/checkout@v5
4563
with:
4664
fetch-depth: 0
65+
persist-credentials: false
4766
- name: Use Node.js 18.x
48-
uses: actions/setup-node@v3
67+
uses: actions/setup-node@v6
4968
with:
5069
node-version: 18.x
51-
- name: Check release is desired
70+
- name: Enable corepack
71+
run: corepack enable
72+
- name: Determine publish info
5273
id: do-publish
5374
run: |
54-
if [ -z "${{ secrets.NPM_TOKEN }}" ]; then
55-
echo "No Token"
56-
elif [[ "${{ github.ref }}" == "refs/heads/master" ]]; then
57-
echo "Publish nightly"
58-
echo "publish=nightly" >> $GITHUB_OUTPUT
75+
# If this run was started manually, choose nightly for main and experimental otherwise.
76+
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
77+
if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
78+
echo "Publishing nightly"
79+
echo "tag=nightly" >> $GITHUB_OUTPUT
80+
else
81+
echo "Publishing experimental"
82+
echo "tag=experimental" >> $GITHUB_OUTPUT
83+
fi
84+
85+
HASH=$(git rev-parse --short HEAD)
86+
TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
87+
PRERELEASE_TAG=nightly-$(echo "${{ github.ref_name }}" | sed -r 's/[^a-z0-9]+/-/gi')
88+
echo "prerelease=${PRERELEASE_TAG}-${TIMESTAMP}-${HASH}" >> $GITHUB_OUTPUT
89+
5990
else
60-
echo "Publish experimental"
61-
echo "publish=experimental" >> $GITHUB_OUTPUT
91+
# Otherwise (push by tag), keep the previous logic: compare published vs package.json
92+
PUBLISHED_VERSION=$(yarn npm info --json . | jq -c '.version' -r)
93+
THIS_VERSION=$(node -p "require('./package.json').version")
94+
# Simple bash helper to compare version numbers
95+
verlte() {
96+
[ "$1" = "`echo -e "$1\n$2" | sort -V | head -n1`" ]
97+
}
98+
verlt() {
99+
[ "$1" = "$2" ] && return 1 || verlte $1 $2
100+
}
101+
if verlt $PUBLISHED_VERSION $THIS_VERSION
102+
then
103+
echo "Publishing latest"
104+
echo "tag=latest" >> $GITHUB_OUTPUT
105+
else
106+
echo "Publishing hotfix"
107+
echo "tag=hotfix" >> $GITHUB_OUTPUT
108+
fi
62109
fi
63-
- name: Prepare Environment
64-
if: ${{ steps.do-publish.outputs.publish }}
110+
- name: Prepare build
65111
run: |
66112
yarn install
67-
env:
68-
CI: true
69-
- name: Bump version and build
70-
if: ${{ steps.do-publish.outputs.publish }}
71-
run: |
72-
PRERELEASE_TAG=nightly-$(echo "${{ github.ref_name }}" | sed -r 's/[^a-z0-9]+/-/gi')
73-
yarn release --prerelease $PRERELEASE_TAG
113+
114+
# Bump to prerelease version if needed
115+
if [ "${{ steps.do-publish.outputs.prerelease }}" != "" ]; then
116+
OLD_VERSION=$(node -p "require('./package.json').version")
117+
yarn version ${OLD_VERSION}-${{ steps.do-publish.outputs.prerelease }}
118+
fi
119+
74120
yarn build
75121
env:
76122
CI: true
123+
124+
- name: Upload release artifact
125+
uses: actions/upload-artifact@v4
126+
with:
127+
name: publish-dist
128+
path: |
129+
dist
130+
package.json
131+
retention-days: 1
132+
if-no-files-found: error
133+
134+
- name: Generate docs
135+
if: ${{ steps.do-publish.outputs.tag == 'latest' }}
136+
run: |
137+
yarn docs:html
138+
- name: Publish docs
139+
uses: peaceiris/actions-gh-pages@v4
140+
if: ${{ steps.do-publish.outputs.tag == 'latest' }}
141+
with:
142+
github_token: ${{ secrets.GITHUB_TOKEN }}
143+
publish_dir: ./docs
144+
145+
publish:
146+
name: Publish to NPM
147+
needs:
148+
- prepare
149+
- test
150+
runs-on: ubuntu-latest
151+
permissions:
152+
contents: read
153+
id-token: write # scoped for as short as possible, as this gives write access to npm
154+
155+
steps:
156+
- uses: actions/checkout@v5
157+
with:
158+
fetch-depth: 0
159+
persist-credentials: false
160+
- name: Use Node.js 24.x
161+
uses: actions/setup-node@v6
162+
with:
163+
node-version: 24.x
164+
165+
- name: Download release artifact
166+
uses: actions/download-artifact@v5
167+
with:
168+
name: publish-dist
169+
77170
- name: Publish to NPM
78-
if: ${{ steps.do-publish.outputs.publish }}
79171
run: |
80-
yarn config set npmAuthToken $NPM_AUTH_TOKEN
172+
corepack enable
173+
yarn install
81174
82-
NEW_VERSION=$(node -p "require('./package.json').version")
83-
yarn npm publish --access=public --tag "${{ steps.do-publish.outputs.publish }}"
175+
# Publish from the extracted release (build output present)
176+
npm publish --access=public --provenance --tag ${{ needs.prepare.outputs.tag }}
84177
178+
NEW_VERSION=$(node -p "require('./package.json').version")
85179
echo "**Published:** $NEW_VERSION" >> $GITHUB_STEP_SUMMARY
86180
env:
87-
NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
88181
CI: true

0 commit comments

Comments
 (0)