Publish #14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| bump: | |
| description: "Version bump type" | |
| required: true | |
| type: choice | |
| options: | |
| - patch | |
| - minor | |
| - major | |
| - prepatch | |
| - preminor | |
| - premajor | |
| - prerelease | |
| preid: | |
| description: "Prerelease identifier (alpha, beta, rc). Only used with pre* bumps." | |
| required: false | |
| type: string | |
| explicit_version: | |
| description: "Explicit version (e.g. 2.0.0-beta.1). Overrides bump and preid when set." | |
| required: false | |
| type: string | |
| dry_run: | |
| description: "Dry run — skip publish, push, and release" | |
| required: false | |
| type: boolean | |
| default: false | |
| concurrency: | |
| group: publish | |
| cancel-in-progress: false | |
| jobs: | |
| checks: | |
| if: github.ref == 'refs/heads/main' || startsWith(inputs.bump, 'pre') || inputs.explicit_version != '' | |
| uses: ./.github/workflows/checks.yml | |
| publish: | |
| if: github.ref == 'refs/heads/main' || startsWith(inputs.bump, 'pre') || inputs.explicit_version != '' | |
| needs: checks | |
| runs-on: ubuntu-latest | |
| # Authentication is handled via OIDC trusted publishing (id-token), | |
| # so no NPM_TOKEN secret is needed. | |
| permissions: | |
| contents: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| registry-url: "https://registry.npmjs.org" | |
| - name: Enable corepack | |
| run: corepack enable pnpm | |
| - name: Get pnpm store directory | |
| id: pnpm-cache | |
| shell: bash | |
| run: | | |
| echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT | |
| - name: Setup pnpm cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: ${{ steps.pnpm-cache.outputs.STORE_PATH }} | |
| key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pnpm-store- | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Build | |
| run: pnpm build | |
| - name: Configure git | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| - name: Bump version | |
| id: version | |
| env: | |
| BUMP: ${{ inputs.bump }} | |
| PREID: ${{ inputs.preid }} | |
| EXPLICIT_VERSION: ${{ inputs.explicit_version }} | |
| run: | | |
| if [[ -n "$EXPLICIT_VERSION" ]]; then | |
| npm version "$EXPLICIT_VERSION" --git-tag-version true | |
| else | |
| ARGS=("$BUMP") | |
| if [[ "$BUMP" == pre* && -n "$PREID" ]]; then | |
| ARGS+=(--preid "$PREID") | |
| fi | |
| npm version "${ARGS[@]}" --git-tag-version true | |
| fi | |
| VERSION=$(node -p "require('./package.json').version") | |
| TAG="v${VERSION}" | |
| echo "version=${VERSION}" >> $GITHUB_OUTPUT | |
| echo "tag=${TAG}" >> $GITHUB_OUTPUT | |
| if [[ "$VERSION" == *-* ]]; then | |
| echo "dist_tag=next" >> $GITHUB_OUTPUT | |
| echo "prerelease=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "dist_tag=latest" >> $GITHUB_OUTPUT | |
| echo "prerelease=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Publish summary | |
| run: | | |
| echo "### Publish Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Version:** ${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Tag:** ${{ steps.version.outputs.tag }}" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Dist tag:** ${{ steps.version.outputs.dist_tag }}" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Prerelease:** ${{ steps.version.outputs.prerelease }}" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Dry run:** ${{ inputs.dry_run }}" >> $GITHUB_STEP_SUMMARY | |
| # Publish before push: npm publish is not retryable (same version | |
| # can't be published twice), while git push is idempotent. If push | |
| # fails after a successful publish, it can simply be retried manually. | |
| - name: Publish to npm | |
| if: ${{ inputs.dry_run == false }} | |
| run: | | |
| npm publish --provenance --tag ${{ steps.version.outputs.dist_tag }} | |
| - name: Push version commit | |
| if: ${{ inputs.dry_run == false }} | |
| run: git push origin HEAD | |
| - name: Push version tag | |
| if: ${{ inputs.dry_run == false }} | |
| run: git push origin ${{ steps.version.outputs.tag }} | |
| - name: Create GitHub Release | |
| if: ${{ inputs.dry_run == false }} | |
| run: | | |
| PRERELEASE_FLAG="" | |
| if [[ "${{ steps.version.outputs.prerelease }}" == "true" ]]; then | |
| PRERELEASE_FLAG="--prerelease" | |
| fi | |
| gh release create "${{ steps.version.outputs.tag }}" \ | |
| --generate-notes \ | |
| $PRERELEASE_FLAG | |
| env: | |
| GH_TOKEN: ${{ github.token }} |