Simulation

Author: SushilMallRC

.github/workflows/oidc-publish-dry-run.yml

@@ -0,0 +1,114 @@
+name: OIDC Publish Dry Run
+
+on:
+  push:
+    branches:
+      - "**"
+    tags-ignore:
+      - "**"
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  id-token: write # required for npm trusted publishing (OIDC)
+  contents: read
+
+concurrency:
+  group: oidc-publish-dry-run-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dry-run:
+    runs-on: ubuntu-latest
+    # Avoid running in forks where npm Trusted Publisher won't match.
+    if: ${{ github.repository == 'ringcentral/ringcentral-js' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22.14.0"
+          registry-url: "https://registry.npmjs.org"
+
+      - run: node --version
+
+      - name: Enable Yarn (Corepack)
+        run: |
+          corepack enable
+          corepack prepare yarn@1.22.22 --activate
+          yarn --version
+
+      - name: Upgrade npm for trusted publishing compatibility
+        run: |
+          npm i -g npm@^11.5.1
+          npm --version
+
+      - run: yarn install
+      - run: npm run build
+
+      - name: Dry-run publish packages to npm (OIDC)
+        env:
+          NODE_AUTH_TOKEN: ""
+          NPM_CONFIG_PROVENANCE: "true"
+        run: |
+          set -euo pipefail
+
+          VERSION="0.0.0-dryrun.${GITHUB_SHA:0:7}"
+          export VERSION
+          echo "Dry-run publishing version: ${VERSION}"
+
+          unset NODE_AUTH_TOKEN
+
+          # Informational only; may fail locally but helps debug in CI.
+          npm whoami --registry=https://registry.npmjs.org || true
+
+          node - <<'NODE'
+          const fs = require('fs');
+          const path = require('path');
+          const { spawnSync } = require('child_process');
+
+          const version = process.env.VERSION;
+          if (!version || version.trim() === '') {
+            console.error('Missing VERSION');
+            process.exit(1);
+          }
+
+          const rootPkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+          const workspaces = rootPkg.workspaces || [];
+
+          function run(cmd, args, cwd) {
+            const res = spawnSync(cmd, args, { cwd, stdio: 'inherit' });
+            if (res.status) process.exit(res.status);
+          }
+
+          const publishTargets = [];
+          for (const ws of workspaces) {
+            const pkgJsonPath = path.join(ws, 'package.json');
+            if (!fs.existsSync(pkgJsonPath)) continue;
+            const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
+            if (pkg.private) continue;
+            if (!pkg.name) continue;
+            publishTargets.push({ dir: ws, name: pkg.name });
+          }
+
+          if (publishTargets.length === 0) {
+            console.log('No public workspaces found to dry-run publish.');
+            process.exit(0);
+          }
+
+          console.log('Dry-run publish targets:');
+          for (const t of publishTargets) console.log(`- ${t.name} (${t.dir})`);
+
+          // Set versions consistently (no git tags/commits in CI).
+          for (const t of publishTargets) {
+            run('npm', ['version', version, '--no-git-tag-version'], t.dir);
+          }
+
+          // Dry-run publish each package using npm OIDC trusted publishing.
+          for (const t of publishTargets) {
+            run('npm', ['publish', '--dry-run', '--provenance', '--access', 'public'], t.dir);
+          }
+          NODE
+

.github/workflows/test.yml

@@ -1,6 +1,6 @@
 name: Test Code
 
-on: [push, pull_request]
+on: [ pull_request]
 
 jobs:
   Test: