[policy] Gate security scans on repository visibility #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| # Publishing three packages is not atomic. Never cancel a run after the first | |
| # package may already have reached npm; the publish script is also idempotent | |
| # so a failed run can safely be retried. | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| # Missing repository variables resolve to an empty string, so a newly | |
| # created repository cannot publish until maintainers explicitly opt in. | |
| if: vars.NPM_RELEASE_ENABLED == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: "1.3.5" | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 | |
| with: | |
| node-version: "24" | |
| registry-url: https://registry.npmjs.org | |
| package-manager-cache: false | |
| - name: Install trusted-publishing npm CLI | |
| run: npm install --global npm@12.0.0 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Verify release | |
| env: | |
| BASE: ${{ github.event.before }} | |
| run: bun run verify:release | |
| - name: Create Release PR or Publish | |
| uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0 | |
| with: | |
| version: bun run release:version | |
| publish: bun run release:publish | |
| commit: "chore: release packages" | |
| title: "chore: release packages" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Bootstrap only: set this secret for the first publication, then remove | |
| # and revoke it after npm Trusted Publishers are configured. With the | |
| # secret absent, npm authenticates through OIDC trusted publishing. | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| NPM_CONFIG_PROVENANCE: "true" |