Skip to content

Commit 4831d37

Browse files
Strum355Strum355
committed
fix: use 'switch' workflow for trusted publishing to npm
1 parent a92f214 commit 4831d37

5 files changed

Lines changed: 238 additions & 120 deletions

File tree

‎.github/workflows/publish-prerelease.yml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
2+
---
3+
name: Publish Prerelease
4+
5+
on:
6+
workflow_call:
7+
inputs:
8+
ref:
9+
description: 'Git ref to publish'
10+
required: true
11+
type: string
12+
13+
jobs:
14+
publish:
15+
runs-on: ubuntu-latest
16+
environment: staging
17+
name: Publish prerelease to NPM
18+
permissions:
19+
contents: write
20+
id-token: write
21+
steps:
22+
- name: Checkout sources
23+
uses: actions/checkout@v4
24+
with:
25+
ref: ${{ inputs.ref }}
26+
fetch-depth: 0
27+
28+
- name: Install node 20
29+
uses: actions/setup-node@v4
30+
with:
31+
node-version: 20
32+
cache: npm
33+
registry-url: 'https://registry.npmjs.org'
34+
35+
- name: Update npm
36+
run: npm install -g npm@11.5.1
37+
38+
- name: Configure git
39+
run: |
40+
git config user.name "${{ github.actor }}"
41+
git config user.email "${{ github.actor }}@users.noreply.github.com"
42+
43+
- name: Update package with new version
44+
id: bump
45+
run: |
46+
echo "version=$(npm version prerelease --no-git-tag-version --preid ea)" >> "$GITHUB_OUTPUT"
47+
48+
- name: Install project modules
49+
run: npm ci
50+
51+
- name: Compile project
52+
run: npm run compile
53+
54+
- name: Publish package
55+
env:
56+
NPM_CONFIG_PROVENANCE: true
57+
run: npm publish --tag prerelease
58+
59+
- name: Commit and push package modifications
60+
run: |
61+
git add package.json
62+
git add package-lock.json
63+
git commit -m "build: updated package with ${{ steps.bump.outputs.version }} [skip ci]"
64+
git push
65+
66+
- name: Create and push new tag
67+
run: |
68+
git tag ${{ steps.bump.outputs.version }} -m "${{ steps.bump.outputs.version }}"
69+
git push origin ${{ steps.bump.outputs.version }}
70+
71+
- name: Create a release
72+
uses: actions/github-script@v6.4.1
73+
with:
74+
github-token: ${{ secrets.GITHUB_TOKEN }}
75+
script: |
76+
const repo_name = context.payload.repository.full_name
77+
const response = await github.request('POST /repos/' + repo_name + '/releases', {
78+
tag_name: '${{ steps.bump.outputs.version }}',
79+
name: '${{ steps.bump.outputs.version }}',
80+
prerelease: true,
81+
generate_release_notes: true
82+
})

‎.github/workflows/publish-release.yml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
2+
---
3+
name: Publish Release
4+
5+
on:
6+
workflow_call:
7+
inputs:
8+
ref:
9+
description: 'Git ref to publish'
10+
required: true
11+
type: string
12+
version_type:
13+
description: 'Type of version bump'
14+
required: true
15+
type: string
16+
17+
jobs:
18+
publish:
19+
runs-on: ubuntu-latest
20+
environment: staging
21+
name: Publish release to NPM
22+
permissions:
23+
contents: write
24+
id-token: write
25+
steps:
26+
- name: Checkout sources
27+
uses: actions/checkout@v4
28+
with:
29+
ref: ${{ inputs.ref }}
30+
fetch-depth: 0
31+
32+
- name: Install node 20
33+
uses: actions/setup-node@v4
34+
with:
35+
node-version: 20
36+
cache: npm
37+
registry-url: 'https://registry.npmjs.org'
38+
39+
- name: Update npm
40+
run: npm install -g npm@11.5.1
41+
42+
- name: Configure git
43+
run: |
44+
git config user.name "${{ github.actor }}"
45+
git config user.email "${{ github.actor }}@users.noreply.github.com"
46+
47+
- name: Get previous released annotated tag
48+
id: last-release
49+
run: |
50+
echo "base-tag=$(git describe | awk -F '-' '{print $1}')" >> "$GITHUB_OUTPUT"
51+
echo "full-tag=$(git describe)" >> "$GITHUB_OUTPUT"
52+
53+
- name: Get first tag in current development iteration
54+
id: fetch-tag
55+
if: contains(steps.last-release.outputs.full-tag , '-ea.')
56+
run: |
57+
echo "oldest-tag=$(git for-each-ref --sort=creatordate --format '%(refname:lstrip=2)' refs/tags | grep ${{ steps.last-release.outputs.base-tag }} | head -n 1)" >> "$GITHUB_OUTPUT"
58+
59+
- name: Update package with new version
60+
id: bump
61+
run: |
62+
echo "version=$(npm version ${{ inputs.version_type }} --no-git-tag-version )" >> "$GITHUB_OUTPUT"
63+
64+
- name: Install project modules
65+
run: npm ci
66+
67+
- name: Compile project
68+
run: npm run compile
69+
70+
- name: Publish package
71+
env:
72+
NPM_CONFIG_PROVENANCE: true
73+
run: npm publish
74+
75+
- name: Commit and push package modifications
76+
run: |
77+
git add package.json
78+
git add package-lock.json
79+
git commit -m "build: updated package with ${{ steps.bump.outputs.version }} [skip ci]"
80+
git push
81+
82+
- name: Create and push new tag
83+
run: |
84+
git tag ${{ steps.bump.outputs.version }} -m "${{ steps.bump.outputs.version }}"
85+
git push origin ${{ steps.bump.outputs.version }}
86+
87+
- name: Create release notes
88+
uses: actions/github-script@v6
89+
id: release-notes
90+
with:
91+
github-token: ${{ secrets.GITHUB_TOKEN }}
92+
script: |
93+
const repo_name = context.payload.repository.full_name
94+
const response = await github.request('POST /repos/' + repo_name + '/releases/generate-notes', {
95+
tag_name: '${{ steps.bump.outputs.version }}',
96+
previous_tag_name: '${{ steps.fetch-tag.outputs.oldest-tag != '' && steps.fetch-tag.outputs.oldest-tag || steps.last-release.outputs.base-tag }}'
97+
})
98+
return response.data.body
99+
100+
- name: Create a release
101+
uses: actions/github-script@v6.4.1
102+
with:
103+
github-token: ${{ secrets.GITHUB_TOKEN }}
104+
script: |
105+
const repo_name = context.payload.repository.full_name
106+
const response = await github.request('POST /repos/' + repo_name + '/releases', {
107+
tag_name: '${{ steps.bump.outputs.version }}',
108+
name: '${{ steps.bump.outputs.version }}',
109+
draft: false,
110+
body: ${{ steps.release-notes.outputs.result }},
111+
prerelease: false,
112+
make_latest: 'true'
113+
})

‎.github/workflows/publish-switch.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
2+
---
3+
name: Publish Switch
4+
5+
on:
6+
workflow_call:
7+
inputs:
8+
ref:
9+
description: 'Git ref to publish'
10+
required: true
11+
type: string
12+
is_prerelease:
13+
description: 'Whether to publish as prerelease'
14+
required: true
15+
type: boolean
16+
version_type:
17+
description: 'Type of version bump (patch/minor/major/prerelease)'
18+
required: false
19+
type: string
20+
default: 'prerelease'
21+
22+
jobs:
23+
prerelease:
24+
if: inputs.is_prerelease == true || inputs.is_prerelease == 'true'
25+
uses: ./.github/workflows/publish-prerelease.yml
26+
with:
27+
ref: ${{ inputs.ref || github.ref }}
28+
29+
release:
30+
if: inputs.is_prerelease == false || inputs.is_prerelease == 'false'
31+
uses: ./.github/workflows/publish-release.yml
32+
with:
33+
ref: ${{ inputs.ref || github.ref }}
34+
version_type: ${{ inputs.version_type || 'patch' }}

‎.github/workflows/release.yml‎

Lines changed: 6 additions & 119 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,6 @@
33
name: Release
44

55
on:
6-
workflow_call:
7-
inputs:
8-
version_type:
9-
description: 'Type of version bump'
10-
required: true
11-
type: string
12-
136
workflow_dispatch:
147
inputs:
158
version_type:
@@ -22,116 +15,10 @@ on:
2215
- minor
2316
- major
2417

25-
permissions:
26-
contents: write
27-
id-token: write
28-
2918
jobs:
30-
release:
31-
runs-on: ubuntu-latest
32-
environment: staging
33-
name: Release the project
34-
steps:
35-
- name: Checkout sources
36-
uses: actions/checkout@v4
37-
with:
38-
fetch-depth: 0
39-
40-
- name: Install node 20
41-
uses: actions/setup-node@v4
42-
with:
43-
node-version: 20
44-
cache: npm
45-
registry-url: 'https://registry.npmjs.org'
46-
47-
- name: Update npm
48-
run: npm install -g npm@11.5.1
49-
50-
- name: Configure git
51-
run: |
52-
git config user.name "${{ github.actor }}"
53-
git config user.email "${{ github.actor }}@users.noreply.github.com"
54-
55-
- name: get previous released annotated tag
56-
id: last-release
57-
run: |
58-
echo "base-tag=$(git describe | awk -F '-' '{print $1}')" >> "$GITHUB_OUTPUT"
59-
echo "full-tag=$(git describe)" >> "$GITHUB_OUTPUT"
60-
61-
- name: get first tag in current development iteration according to base
62-
id: fetch-tag
63-
if: ${{ contains(steps.last-release.outputs.full-tag , '-ea.') }}
64-
run: |
65-
echo "oldest-tag=$(git for-each-ref --sort=creatordate --format '%(refname:lstrip=2)' refs/tags | grep ${{ steps.last-release.outputs.base-tag }} | head -n 1)" >> "$GITHUB_OUTPUT"
66-
67-
- name: determine semver component to bump
68-
id: bump-decision
69-
run: |
70-
echo "bump-part=${{ inputs.version_type }}" >> "$GITHUB_OUTPUT"
71-
72-
- name: Update package with new version
73-
id: bump
74-
run: |
75-
if [[ "${{ inputs.version_type }}" == "prerelease" ]]; then
76-
echo "version=$(npm version prerelease --no-git-tag-version --preid ea)" >> "$GITHUB_OUTPUT"
77-
else
78-
echo "version=$(npm version ${{ steps.bump-decision.outputs.bump-part }} --no-git-tag-version )" >> "$GITHUB_OUTPUT"
79-
fi
80-
81-
- name: Install project modules
82-
run: npm ci
83-
84-
- name: Compile project
85-
run: npm run compile
86-
87-
- name: Publish package
88-
run: npm publish --access public --provenance ${{ inputs.version_type == 'prerelease' && '--tag prerelease' || '' }}
89-
90-
- name: Commit and push package modifications
91-
run: |
92-
git add package.json
93-
git add package-lock.json
94-
git commit -m "build: updated package with ${{ steps.bump.outputs.version }} [skip ci]"
95-
git push
96-
97-
- name: Create and push new tag
98-
run: |
99-
git tag ${{ steps.bump.outputs.version }} -m "${{ steps.bump.outputs.version }}"
100-
git push origin ${{ steps.bump.outputs.version }}
101-
102-
- name: Create release notes for ${{ steps.bump.outputs.version }} release
103-
if: inputs.version_type != 'prerelease'
104-
uses: actions/github-script@v6
105-
id: release-notes
106-
with:
107-
github-token: ${{ secrets.GITHUB_TOKEN }}
108-
script: |
109-
const repo_name = context.payload.repository.full_name
110-
const response = await github.request('POST /repos/' + repo_name + '/releases/generate-notes', {
111-
tag_name: '${{ steps.bump.outputs.version }}',
112-
previous_tag_name: '${{ steps.fetch-tag.outputs.oldest-tag != '' && steps.fetch-tag.outputs.oldest-tag || steps.last-release.outputs.base-tag }}'
113-
})
114-
return response.data.body
115-
116-
- name: Create a release
117-
uses: actions/github-script@v6.4.1
118-
with:
119-
github-token: ${{ secrets.GITHUB_TOKEN }}
120-
script: |
121-
const repo_name = context.payload.repository.full_name
122-
const isPrerelease = '${{ inputs.version_type }}' === 'prerelease';
123-
const releaseConfig = {
124-
tag_name: '${{ steps.bump.outputs.version }}',
125-
name: '${{ steps.bump.outputs.version }}',
126-
prerelease: isPrerelease
127-
};
128-
129-
if (isPrerelease) {
130-
releaseConfig.generate_release_notes = true;
131-
} else {
132-
releaseConfig.draft = false;
133-
releaseConfig.body = ${{ steps.release-notes.outputs.result }};
134-
releaseConfig.make_latest = 'true';
135-
}
136-
137-
const response = await github.request('POST /repos/' + repo_name + '/releases', releaseConfig);
19+
publish-release:
20+
uses: ./.github/workflows/publish-switch.yml
21+
with:
22+
ref: ${{ github.ref }}
23+
is_prerelease: false
24+
version_type: ${{ inputs.version_type }}

‎.github/workflows/stage.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,8 @@ jobs:
121121
122122
publish-prerelease:
123123
needs: test
124-
uses: ./.github/workflows/release.yml
124+
uses: ./.github/workflows/publish-switch.yml
125125
with:
126+
ref: ${{ github.sha }}
127+
is_prerelease: true
126128
version_type: prerelease

0 commit comments

Comments
 (0)