Skip to content

Commit cbb63dc

Browse files
SushilMallRCSushilMallRC
committed
WIP
1 parent 1c74726 commit cbb63dc

1 file changed

Lines changed: 208 additions & 0 deletions

File tree

‎.github/workflows/oidc-publish-dry-run.yml‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
name: OIDC Publish Dry Run
2+
3+
on:
4+
push:
5+
branches:
6+
- "**"
7+
tags-ignore:
8+
- "**"
9+
pull_request:
10+
workflow_dispatch:
11+
inputs:
12+
version:
13+
description: "Version to test (ex: 5.0.10 or 5.0.10-rc.1). Used only for dry-run tarball/version checks."
14+
required: false
15+
default: ""
16+
type: string
17+
node_version:
18+
description: "Node version to use"
19+
required: false
20+
default: "22.14.0"
21+
type: string
22+
23+
permissions:
24+
id-token: write # required for npm trusted publishing (OIDC)
25+
contents: read
26+
27+
concurrency:
28+
group: oidc-publish-dry-run-${{ github.ref }}
29+
cancel-in-progress: true
30+
31+
jobs:
32+
dry-run:
33+
runs-on: ubuntu-latest
34+
steps:
35+
- name: Checkout
36+
uses: actions/checkout@v4
37+
38+
- name: Use Node.js
39+
uses: actions/setup-node@v4
40+
with:
41+
node-version: ${{ github.event.inputs.node_version || '22.14.0' }}
42+
registry-url: "https://registry.npmjs.org"
43+
44+
- run: node --version
45+
46+
- name: Enable Yarn (Corepack)
47+
run: |
48+
corepack enable
49+
corepack prepare yarn@1.22.22 --activate
50+
yarn --version
51+
52+
- name: Upgrade npm for trusted publishing compatibility
53+
run: |
54+
npm i -g npm@^11.5.1
55+
npm --version
56+
57+
- run: yarn install
58+
- run: npm run build
59+
60+
- name: Pack workspace tarballs (verify contents)
61+
env:
62+
INPUT_VERSION: ${{ github.event.inputs.version || '' }}
63+
run: |
64+
set -euo pipefail
65+
66+
if [ -n "${INPUT_VERSION}" ]; then
67+
VERSION="${INPUT_VERSION}"
68+
else
69+
VERSION="0.0.0-dryrun.${GITHUB_SHA:0:7}"
70+
fi
71+
export VERSION
72+
echo "Packing version: ${VERSION}"
73+
mkdir -p .artifacts/npm-pack
74+
75+
node - <<'NODE'
76+
const fs = require('fs');
77+
const path = require('path');
78+
const { spawnSync } = require('child_process');
79+
80+
const version = process.env.VERSION;
81+
if (!version || version.trim() === '') {
82+
console.error('Missing VERSION');
83+
process.exit(1);
84+
}
85+
const outDir = path.join(process.cwd(), '.artifacts', 'npm-pack');
86+
87+
const rootPkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
88+
const workspaces = rootPkg.workspaces || [];
89+
90+
function run(cmd, args, cwd) {
91+
const res = spawnSync(cmd, args, { cwd, stdio: 'inherit' });
92+
if (res.status) process.exit(res.status);
93+
}
94+
95+
const targets = [];
96+
for (const ws of workspaces) {
97+
const pkgJsonPath = path.join(ws, 'package.json');
98+
if (!fs.existsSync(pkgJsonPath)) continue;
99+
const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
100+
if (pkg.private) continue;
101+
if (!pkg.name) continue;
102+
targets.push({ dir: ws, name: pkg.name });
103+
}
104+
105+
if (targets.length === 0) {
106+
console.log('No public workspaces found to pack.');
107+
process.exit(0);
108+
}
109+
110+
console.log('Pack targets:');
111+
for (const t of targets) console.log(`- ${t.name} (${t.dir})`);
112+
113+
// Set versions consistently (no git tags/commits in CI).
114+
for (const t of targets) {
115+
run('npm', ['version', version, '--no-git-tag-version'], t.dir);
116+
}
117+
118+
// Create tarballs for inspection.
119+
for (const t of targets) {
120+
// npm pack prints the filename as its last line.
121+
const res = spawnSync('npm', ['pack'], { cwd: t.dir, stdio: ['ignore', 'pipe', 'inherit'] });
122+
if (res.status) process.exit(res.status);
123+
const filename = String(res.stdout || '').trim().split('\n').pop();
124+
if (!filename) {
125+
console.error(`npm pack did not output a filename for ${t.name}`);
126+
process.exit(1);
127+
}
128+
const src = path.join(process.cwd(), t.dir, filename);
129+
const safeName = t.name.replace('/', '-').replace('@', '');
130+
const dest = path.join(outDir, `${safeName}-${version}.tgz`);
131+
fs.renameSync(src, dest);
132+
console.log(`Packed ${t.name} -> ${path.relative(process.cwd(), dest)}`);
133+
}
134+
NODE
135+
136+
- name: Upload packed tarballs
137+
uses: actions/upload-artifact@v4
138+
with:
139+
name: npm-pack-tarballs
140+
path: .artifacts/npm-pack/*.tgz
141+
142+
- name: Dry-run publish packages to npm (OIDC)
143+
if: ${{ github.repository == 'ringcentral/ringcentral-js' }}
144+
env:
145+
NODE_AUTH_TOKEN: ""
146+
NPM_CONFIG_PROVENANCE: "true"
147+
INPUT_VERSION: ${{ github.event.inputs.version || '' }}
148+
run: |
149+
set -euo pipefail
150+
151+
if [ -n "${INPUT_VERSION}" ]; then
152+
VERSION="${INPUT_VERSION}"
153+
else
154+
VERSION="0.0.0-dryrun.${GITHUB_SHA:0:7}"
155+
fi
156+
export VERSION
157+
echo "Dry-run publishing version: ${VERSION}"
158+
159+
unset NODE_AUTH_TOKEN
160+
161+
node - <<'NODE'
162+
const fs = require('fs');
163+
const path = require('path');
164+
const { spawnSync } = require('child_process');
165+
166+
const version = process.env.VERSION;
167+
if (!version || version.trim() === '') {
168+
console.error('Missing VERSION');
169+
process.exit(1);
170+
}
171+
const publishTag = 'dry-run';
172+
173+
const rootPkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
174+
const workspaces = rootPkg.workspaces || [];
175+
176+
function run(cmd, args, cwd) {
177+
const res = spawnSync(cmd, args, { cwd, stdio: 'inherit' });
178+
if (res.status) process.exit(res.status);
179+
}
180+
181+
const targets = [];
182+
for (const ws of workspaces) {
183+
const pkgJsonPath = path.join(ws, 'package.json');
184+
if (!fs.existsSync(pkgJsonPath)) continue;
185+
const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
186+
if (pkg.private) continue;
187+
if (!pkg.name) continue;
188+
targets.push({ dir: ws, name: pkg.name });
189+
}
190+
191+
if (targets.length === 0) {
192+
console.log('No public workspaces found to dry-run publish.');
193+
process.exit(0);
194+
}
195+
196+
console.log('Dry-run publish targets:');
197+
for (const t of targets) console.log(`- ${t.name} (${t.dir})`);
198+
199+
// Set versions consistently (no git tags/commits in CI).
200+
for (const t of targets) {
201+
run('npm', ['version', version, '--no-git-tag-version'], t.dir);
202+
}
203+
204+
for (const t of targets) {
205+
run('npm', ['publish', '--dry-run', '--provenance', '--access', 'public', '--tag', publishTag], t.dir);
206+
}
207+
NODE
208+

0 commit comments

Comments
 (0)