Merge pull request #152 from block/chai/release-attach-tarball

ci: attach .tgz to GitHub Release on npm publish

Author: chailandau

.github/workflows/release-tarball.yml

@@ -1,17 +1,16 @@
 name: Publish tarball to GitHub Release
 
-# Temporary distribution channel while npm publish is blocked. Packs
+# Manual fallback for the tarball distribution channel. Packs
 # @anarchitecture/ghost and attaches the .tgz to a GitHub Release, so consumers can:
 #
 #   npm install https://github.com/block/ghost/releases/download/<tag>/<file>.tgz
 #
-# Triggered by pushing a tag of the form `anarchitecture-ghost@<version>` or by
-# manual workflow_dispatch.
+# The normal path is release.yml, which attaches the tarball automatically on
+# every Changesets publish. This workflow is dispatch-only so a Changesets-
+# created tag does not fire both workflows and race on the same Release. Use it
+# to (re)cut a tarball for an existing version without a fresh npm publish.
 
 on:
-  push:
-    tags:
-      - "anarchitecture-ghost@*"
   workflow_dispatch:
     inputs:
       version:
@@ -60,17 +59,16 @@ jobs:
       # controlled (anyone with Actions write can trigger). Pass them in via
       # `env:` and reference as shell variables so they can't be interpolated
       # as shell syntax — that's what the semgrep shell-injection rule wants.
+      # Inputs from workflow_dispatch are attacker-controlled (anyone with
+      # Actions write can trigger). Pass them in via `env:` and reference as
+      # shell variables so they can't be interpolated as shell syntax — that's
+      # what the semgrep shell-injection rule wants.
       - name: Resolve tag
         id: tag
         env:
-          EVENT_NAME: ${{ github.event_name }}
           INPUT_VERSION: ${{ inputs.version }}
         run: |
-          if [ "$EVENT_NAME" = "push" ]; then
-            TAG="$GITHUB_REF_NAME"
-          else
-            TAG="anarchitecture-ghost@$INPUT_VERSION"
-          fi
+          TAG="anarchitecture-ghost@$INPUT_VERSION"
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
       - name: Create GitHub Release

.github/workflows/release.yml

@@ -37,6 +37,7 @@ jobs:
       - run: pnpm --filter @anarchitecture/ghost build
 
       - name: Create Release PR or publish
+        id: changesets
         uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0
         with:
           publish: npm publish ./packages/ghost --access public --provenance
@@ -47,3 +48,28 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.GHOST_NPM_PUBLISH_TOKEN }}
           NODE_AUTH_TOKEN: ${{ secrets.GHOST_NPM_PUBLISH_TOKEN }}
+
+      # When a publish actually happened, Changesets has already created and
+      # tagged a GitHub Release (createGithubReleases defaults to true). Pack
+      # the public package and attach the .tgz to that same Release so the
+      # tarball distribution channel stays in sync with npm — no separate tag
+      # push required.
+      - name: Attach tarball to GitHub Release
+        if: steps.changesets.outputs.published == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PUBLISHED_PACKAGES: ${{ steps.changesets.outputs.publishedPackages }}
+        run: |
+          VERSION="$(echo "$PUBLISHED_PACKAGES" \
+            | python3 -c "import json,sys; pkgs=json.load(sys.stdin); print(next(p['version'] for p in pkgs if p['name']=='@anarchitecture/ghost'))")"
+          TAG="anarchitecture-ghost@${VERSION}"
+          mkdir -p dist-tarball
+          pnpm --filter @anarchitecture/ghost pack --pack-destination "$GITHUB_WORKSPACE/dist-tarball"
+          ls -la dist-tarball
+          # Changesets creates the GitHub Release (createGithubReleases default).
+          # If it ever isn't there yet, create it so the upload always has a
+          # target — keeps the release from failing on a tooling change.
+          if ! gh release view "$TAG" >/dev/null 2>&1; then
+            gh release create "$TAG" --title "$TAG" --generate-notes
+          fi
+          gh release upload "$TAG" dist-tarball/*.tgz --clobber