react-native-firebase/.github/workflows/publish.yml at main · jsnavarroc/react-native-firebase · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
name: Publish

on:
  workflow_dispatch:

jobs:
  publish_npm:
    if: "(github.repository == 'invertase/react-native-firebase') && (github.event_name == 'workflow_dispatch')"
    name: 'NPM'
    timeout-minutes: 30
    runs-on: ubuntu-latest
    permissions:
      id-token: write # enables OIDC for npmjs.com "Trusted Publisher" and provenance
      contents: read
    steps:
      # https://github.com/actions/checkout/releases
      - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
        with:
          fetch-depth: 0
          # Repository admin required to evade PR+checks branch protection
          token: ${{ secrets.GH_TOKEN }}
      # https://github.com/actions/setup-node/releases
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: lts/*
          registry-url: 'https://registry.npmjs.org'
      - name: Install latest NPM
        # OIDC publishing requires a very up to date npm version
        run: |
          npm --version
          npm install -g npm@latest
          npm --version
      - name: Yarn Install
        # https://github.com/nick-fields/retry/releases
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
        with:
          timeout_minutes: 15
          retry_wait_seconds: 60
          max_attempts: 3
          command: yarn
      - name: GIT Setup
        # Alter branding of release commit, despite GITHUB_TOKEN having real owner
        run: |
          git config --global user.name 'Invertase Publisher'
          git config --global user.email 'oss@invertase.io'
      - name: Publish Packages
        run: |
          npx envinfo
          echo "Verifying working directory is clean..."
          git diff --exit-code
          echo "Displaying any current changes..."
          if yarn lerna changed; then
            echo "Changes detected, bumping versions..."
            yarn lerna version --yes --force-publish=*
          else
            echo "No changes detected, no versions bumped."
          fi
          echo "Syncing unpublished versions with package registry..."
          yarn lerna publish from-package --yes --loglevel trace
        env:
          # No NPM token needed, all of the packages have been configured
          # on npmjs.com with this workflow file as an OIDC "Trusted Publisher"
          # As of 20251208 tokenless OIDC Trusted Publish is not working.
          # Unable to conclusively fix, using token for now. Expires 20250308
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          #
          # org admin Github Token required for the changelog/tag commit+push
          # to work via an exception to branch protection rules
          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}

  deploy-api-reference:
    name: 'Deploy API Reference'
    needs: publish_npm
    uses: ./.github/workflows/deploy-api-reference.yml
    permissions:
      contents: read
      pages: write
      id-token: write