react-sdk/.github/workflows/react_release.yml at ace663e9727ef84df808570d90cde75c119064e6 · optimizely/react-sdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
name: Publish React SDK

on:
  release:
    types: [ published ]
  workflow_dispatch: {}

permissions:
  id-token: write
  contents: read
  packages: write

jobs:
  publish:
    name: Publish to NPM and GitHub Package Registry
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' || !github.event.release.draft }}
    environment: npm
    steps:
    - name: Checkout branch
      uses: actions/checkout@v4
      with:
        persist-credentials: false

    - name: Set up Node
      uses: actions/setup-node@v4
      with:
        node-version: 22
        cache: 'npm'

    - name: Upgrade npm for OIDC support
      run: npm install -g npm@latest

    - name: Configure GHR auth
      run: echo "//npm.pkg.github.com/:_authToken=\${NODE_AUTH_TOKEN}" >> ~/.npmrc

    - name: Install dependencies
      run: npm ci --ignore-scripts

    - name: Test, build, and pack
      id: pack
      run: |
        npm run test
        npm run build
        tarball=$(npm pack --ignore-scripts | tail -n1)
        echo "tarball=$tarball" >> "$GITHUB_OUTPUT"

    # npm publish uses OIDC trusted publishing (no token needed).
    # publish.sh adds --provenance for supply-chain attestations.
    - name: Publish to NPM
      env:
        TARBALL: ${{ steps.pack.outputs.tarball }}
        DRY_RUN: ${{ github.event_name == 'workflow_dispatch' }}
      run: scripts/publish.sh "https://registry.npmjs.org" "$TARBALL"

    - name: Publish to GitHub Package Registry
      env:
        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        TARBALL: ${{ steps.pack.outputs.tarball }}
        DRY_RUN: ${{ github.event_name == 'workflow_dispatch' }}
      run: scripts/publish.sh "https://npm.pkg.github.com" "$TARBALL"