link-cli/.github/workflows/release.yml at main · danielblake638/link-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
name: Release

on:
  push:
    branches: [main]

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: write
  pull-requests: write
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    outputs:
      published: ${{ steps.changesets.outputs.published }}
      publishedPackages: ${{ steps.changesets.outputs.publishedPackages }}
    steps:
      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
          registry-url: https://registry.npmjs.org

      - run: pnpm install --frozen-lockfile

      - run: pnpm turbo run build

      - name: Create release PR or publish
        id: changesets
        uses: changesets/action@v1
        with:
          publish: pnpm changeset publish
          title: 'Version Packages'
          commit: 'Version Packages'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Upload built CLI to GitHub Release
        if: steps.changesets.outputs.published == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG=$(echo '${{ steps.changesets.outputs.publishedPackages }}' \
            | jq -r '.[] | select(.name == "@stripe/link-cli") | "@stripe/link-cli@" + .version')
          if [ -n "$TAG" ]; then
            sha256sum packages/cli/dist/cli.js > packages/cli/dist/cli.js.sha256
            gh release upload "$TAG" packages/cli/dist/cli.js packages/cli/dist/cli.js.sha256 --clobber
          fi

  build-sea:
    needs: release
    if: needs.release.outputs.published == 'true'
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            asset_name: link-cli-linux-x64
          - os: macos-latest
            asset_name: link-cli-macos-arm64
          - os: windows-latest
            asset_name: link-cli-win-x64.exe
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 26
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm turbo run build
      - run: pnpm --filter @stripe/link-cli run build:sea

      - name: Build SEA
        run: node --build-sea packages/cli/sea-config.json

      - name: Rename binary (Unix)
        if: runner.os != 'Windows'
        run: mv sea-output ${{ matrix.asset_name }} && chmod +x ${{ matrix.asset_name }}

      - name: Rename binary (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: Rename-Item sea-output ${{ matrix.asset_name }}

      - name: Sign binary (macOS only)
        if: runner.os == 'macOS'
        run: codesign --sign - ${{ matrix.asset_name }}

      - name: Generate checksum
        shell: bash
        run: sha256sum ${{ matrix.asset_name }} > ${{ matrix.asset_name }}.sha256

      - name: Upload to release
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG=$(echo '${{ needs.release.outputs.publishedPackages }}' \
            | jq -r '.[] | select(.name == "@stripe/link-cli") | "@stripe/link-cli@" + .version')
          gh release upload "$TAG" \
            ${{ matrix.asset_name }} \
            ${{ matrix.asset_name }}.sha256 \
            --clobber