117 lines
4.1 KiB
YAML
117 lines
4.1 KiB
YAML
name: Release
|
|
|
|
# Publishes `dsh-apes-sidebar` to npm via npm Trusted Publishing (OIDC) —
|
|
# no NPM_TOKEN secret required, provenance is attached to the tarball.
|
|
#
|
|
# Trigger: a GitHub Release is published (tag vX.Y.Z). The tag MUST match
|
|
# package.json `version`; the workflow verifies this before publishing.
|
|
#
|
|
# Dist-tag policy: a PRERELEASE version (e.g. v0.18.0-alpha.0 — the DSH
|
|
# 0.1.2-alpha adapter track) publishes under the npm `alpha` dist-tag so the
|
|
# `latest` install target keeps pointing at the last stable cut (which
|
|
# supports the stable DSH line); stable versions publish as `latest`.
|
|
#
|
|
# One-time npm-side setup (manual, on npmjs.com):
|
|
# 1. package `dsh-apes-sidebar` -> Settings -> Publishing access
|
|
# -> Trusted Publishers -> "Add Trusted Publisher".
|
|
# 2. Provider: GitHub Actions
|
|
# Organization or user: omdsh-dev
|
|
# Repository: DSH-better-sidebar
|
|
# Workflow filename: release.yml
|
|
# Environment: (blank)
|
|
# 3. Save. Do NOT add an NPM_TOKEN secret — Trusted Publishing replaces it.
|
|
# Canonical reference: https://docs.npmjs.com/trusted-publishers
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
workflow_dispatch:
|
|
inputs:
|
|
dry_run:
|
|
description: Pack and verify everything, but do not publish
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: write # mint the OIDC token npm Trusted Publishing exchanges
|
|
|
|
concurrency:
|
|
group: npm-release
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
publish:
|
|
name: build · verify · publish
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
# Tests run git log against this repository and need full history.
|
|
fetch-depth: 0
|
|
|
|
# pnpm version is pinned via packageManager in package.json; the action
|
|
# reads it from there (specifying both makes action-setup fail on
|
|
# purpose with ERR_PNPM_BAD_PM_VERSION).
|
|
- uses: pnpm/action-setup@v6
|
|
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 22
|
|
registry-url: https://registry.npmjs.org
|
|
cache: pnpm
|
|
|
|
# The plugin's git revert/cherry-pick spawn git without an identity
|
|
# (see tests/smoke.spec.ts); the runner has none by default.
|
|
- name: Configure git identity for tests
|
|
run: |
|
|
git config --global user.name "dsh-apes-sidebar-ci"
|
|
git config --global user.email "ci@dsh.invalid"
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Verify release tag matches package.json version
|
|
if: github.event_name == 'release'
|
|
env:
|
|
RELEASE_TAG: ${{ github.event.release.tag_name }}
|
|
run: |
|
|
expected="v$(node -p "require('./package.json').version")"
|
|
echo "package.json version: ${expected#v}"
|
|
echo "release tag: ${RELEASE_TAG}"
|
|
if [ "${RELEASE_TAG}" != "${expected}" ]; then
|
|
echo "::error::Release tag ${RELEASE_TAG} does not match package.json version ${expected#v} (expected ${expected})."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Typecheck
|
|
run: pnpm typecheck
|
|
|
|
- name: Lint
|
|
run: pnpm lint
|
|
|
|
- name: Test
|
|
run: pnpm test
|
|
|
|
- name: Build
|
|
run: pnpm build
|
|
|
|
# The consumer-facing declaration surface guard — mirrors the ci.yml
|
|
# verification order (typecheck → lint → test → build →
|
|
# check:consumer-types) so a release is gated on the same checks a PR
|
|
# runs.
|
|
- name: Check consumer type surface
|
|
run: pnpm check:consumer-types
|
|
|
|
- name: Dry-run publish (validation only)
|
|
if: github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true'
|
|
run: pnpm publish --dry-run --no-git-checks
|
|
|
|
- name: Publish to npm
|
|
if: github.event_name == 'release' || github.event.inputs.dry_run != 'true'
|
|
run: |
|
|
TAG=$(node -p "require('./package.json').version.includes('-') ? 'alpha' : 'latest'")
|
|
echo "publishing to npm dist-tag: ${TAG}"
|
|
pnpm publish --provenance --access public --no-git-checks --tag "$TAG"
|