Bump to 1.0.2 #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to npm | |
| # Publishes to npm when a GitHub Release is published, OR when you push a | |
| # version tag like v1.2.3. (Publishing on *every commit* is intentionally | |
| # avoided — npm rejects re-publishing an unchanged version.) | |
| on: | |
| release: | |
| types: [published] | |
| push: | |
| tags: | |
| - "v*.*.*" | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write # enables npm provenance | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| registry-url: "https://registry.npmjs.org" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Guard — tag/release version must match package.json | |
| run: | | |
| REF="${GITHUB_REF_NAME#v}" | |
| PKG="$(node -p "require('./package.json').version")" | |
| if [ "$REF" != "$PKG" ]; then | |
| echo "::error::Tag/release ($REF) does not match package.json version ($PKG)" | |
| exit 1 | |
| fi | |
| echo "Publishing version $PKG" | |
| - name: Publish | |
| run: npm publish --provenance --access public | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} |