Publish npm #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish npm | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| channel: | |
| description: npm channel to publish | |
| required: true | |
| type: choice | |
| options: | |
| - beta | |
| - stable | |
| confirm: | |
| description: Type PUBLISH to confirm | |
| required: true | |
| type: string | |
| concurrency: | |
| # Publishing three packages is not atomic. Never cancel a run after the first | |
| # package may already have reached npm; exact versions are safe to retry. | |
| group: npm-publish | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| if: vars.NPM_RELEASE_ENABLED == 'true' && inputs.confirm == 'PUBLISH' | |
| runs-on: ubuntu-latest | |
| environment: npm-release | |
| permissions: | |
| contents: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version: "1.3.5" | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 | |
| with: | |
| node-version: "24" | |
| registry-url: https://registry.npmjs.org | |
| package-manager-cache: false | |
| - name: Install trusted-publishing npm CLI | |
| run: | | |
| npm install --global npm@12.0.1 | |
| npm --version | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Validate channel, branch, and package versions | |
| id: release | |
| run: >- | |
| bun run scripts/release/channel.ts validate | |
| --channel "${{ inputs.channel }}" | |
| --ref "${{ github.ref_name }}" | |
| --output "$GITHUB_OUTPUT" | |
| - name: Verify release | |
| run: bun run verify:release | |
| - name: Publish packages with npm Trusted Publishing | |
| env: | |
| NPM_CONFIG_PROVENANCE: "true" | |
| run: bun run release:publish | |
| - name: Create immutable Git tag | |
| env: | |
| VERSION: ${{ steps.release.outputs.version }} | |
| run: | | |
| tag="v${VERSION}" | |
| if git rev-parse --verify --quiet "refs/tags/${tag}"; then | |
| test "$(git rev-list -n 1 "${tag}")" = "$GITHUB_SHA" || { | |
| echo "::error::${tag} already points to another commit" | |
| exit 1 | |
| } | |
| else | |
| git tag --annotate "${tag}" --message "${tag}" | |
| git push origin "${tag}" | |
| fi | |
| - name: Create GitHub Release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| VERSION: ${{ steps.release.outputs.version }} | |
| CHANNEL: ${{ steps.release.outputs.channel }} | |
| run: | | |
| tag="v${VERSION}" | |
| if gh release view "${tag}" >/dev/null 2>&1; then | |
| echo "GitHub Release ${tag} already exists; nothing to do." | |
| elif test "${CHANNEL}" = beta; then | |
| gh release create "${tag}" --verify-tag --generate-notes --prerelease --title "${tag}" | |
| else | |
| gh release create "${tag}" --verify-tag --generate-notes --title "${tag}" | |
| fi |