Publish #114
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| on: | |
| workflow_run: | |
| workflows: ["Release"] | |
| types: [completed] | |
| workflow_dispatch: | |
| inputs: | |
| action: | |
| description: "Action to perform" | |
| required: true | |
| type: choice | |
| options: | |
| - publish-next | |
| - publish-latest | |
| default: publish-next | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| id-token: write | |
| jobs: | |
| publish: | |
| if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '24' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Upgrade npm | |
| run: npm install -g npm@latest | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version-file: package.json | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Detect channel | |
| id: channel | |
| run: | | |
| if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then | |
| echo "action=${{ inputs.action }}" >> $GITHUB_OUTPUT | |
| else | |
| VERSION=$(node -p "require('./apps/cli/package.json').version") | |
| if [[ "$VERSION" == *"-next."* ]]; then | |
| echo "action=publish-next" >> $GITHUB_OUTPUT | |
| else | |
| echo "action=publish-latest" >> $GITHUB_OUTPUT | |
| fi | |
| fi | |
| # Latest promotion is blocked on a tiny live contract eval. The gate uses | |
| # a Models-capable PAT secret, while npm publish still uses NPM_TOKEN. | |
| - name: Run contract eval gate | |
| if: steps.channel.outputs.action == 'publish-latest' | |
| run: bun run contract-eval | |
| env: | |
| GH_MODELS_TOKEN: ${{ secrets.GH_MODELS_TOKEN }} | |
| CONTRACT_EVAL_MODEL: ${{ vars.CONTRACT_EVAL_MODEL || 'openai/gpt-4.1-mini' }} | |
| - name: Publish to npm | |
| run: | | |
| if [ "${{ steps.channel.outputs.action }}" = "publish-next" ]; then | |
| bun run publish:next | |
| else | |
| bun run publish | |
| fi | |
| env: | |
| NPM_CONFIG_PROVENANCE: true | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} |