cli/.github/workflows/release.yml at master · laststate/cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
name: Release
# Tag a release with: git tag vX.Y.Z && git push origin vX.Y.Z
# The tag MUST equal package.json version (checked below).
#
# npm auth: trusted publishing (OIDC) is preferred — configure it once on
# npmjs.com (package settings > Trusted publisher > GitHub Actions, this repo
# + .github/workflows/release.yml). When `NPM_TOKEN` (automation token) is set
# as a repo secret, the workflow falls back to it; otherwise it uses OIDC.
# Without either, the first publish fails with
# `404 'laststate-cli@x.y.z' is not in this registry`.
on:
  push:
    tags: ['v*']
permissions:
  contents: write
  id-token: write
jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
      - name: Validate tag matches package.json
        shell: bash
        run: |
          tag="${GITHUB_REF_NAME}"
          if ! [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
            echo "Tag '$tag' is not semver vMAJOR.MINOR.PATCH[-PRERELEASE]" >&2
            exit 1
          fi
          pkg="v$(node -p "require('./package.json').version")"
          if [ "$tag" != "$pkg" ]; then
            echo "Tag $tag does not match package.json version $pkg" >&2
            exit 1
          fi
      - uses: actions/setup-node@v7
        with:
          node-version: 20
          cache: npm
          registry-url: https://registry.npmjs.org
      - name: Install, build, test
        run: |
          npm ci
          npm run build
          npm test
      - name: Publish to npm
        # First publish needs --access public (publishConfig covers it, flag
        # kept for explicitness). Provenance requires OIDC; token auth must
        # publish without it.
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          if [ -n "$NPM_TOKEN" ]; then
            echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > "$NPM_CONFIG_USERCONFIG"
            npm publish --access public
          else
            npm publish --provenance --access public
          fi
      - name: Pack tarball for the GitHub release
        run: |
          npm pack
          mkdir -p dist-release && mv laststate-cli-*.tgz dist-release/
      - name: Smoke test published package
        run: |
          cd "$(mktemp -d)"
          for i in $(seq 1 10); do
            npm install laststate-cli@"${GITHUB_REF_NAME#v}" --no-save && break
            echo "retry $i: package not yet visible on registry" >&2
            sleep 15
          done
          npx laststate --help
      - name: Create GitHub release
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v2
        with:
          tag_name: ${{ github.ref_name }}
          name: Release ${{ github.ref_name }}
          generate_release_notes: true
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}
          files: dist-release/*.tgz
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}