Skip to content

Publish

Publish #114

Workflow file for this run

name: Publish
on:
workflow_run:
workflows: ["Release"]
types: [completed]
workflow_dispatch:
inputs:
action:
description: "Action to perform"
required: true
type: choice
options:
- publish-next
- publish-latest
default: publish-next
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: false
permissions:
contents: read
id-token: write
jobs:
publish:
if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: '24'
registry-url: 'https://registry.npmjs.org'
- name: Upgrade npm
run: npm install -g npm@latest
- name: Setup Bun
uses: oven-sh/setup-bun@v2
with:
bun-version-file: package.json
- name: Install dependencies
run: bun install --frozen-lockfile
- name: Detect channel
id: channel
run: |
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
echo "action=${{ inputs.action }}" >> $GITHUB_OUTPUT
else
VERSION=$(node -p "require('./apps/cli/package.json').version")
if [[ "$VERSION" == *"-next."* ]]; then
echo "action=publish-next" >> $GITHUB_OUTPUT
else
echo "action=publish-latest" >> $GITHUB_OUTPUT
fi
fi
# Latest promotion is blocked on a tiny live contract eval. The gate uses
# a Models-capable PAT secret, while npm publish still uses NPM_TOKEN.
- name: Run contract eval gate
if: steps.channel.outputs.action == 'publish-latest'
run: bun run contract-eval
env:
GH_MODELS_TOKEN: ${{ secrets.GH_MODELS_TOKEN }}
CONTRACT_EVAL_MODEL: ${{ vars.CONTRACT_EVAL_MODEL || 'openai/gpt-4.1-mini' }}
- name: Publish to npm
run: |
if [ "${{ steps.channel.outputs.action }}" = "publish-next" ]; then
bun run publish:next
else
bun run publish
fi
env:
NPM_CONFIG_PROVENANCE: true
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}