v1.2.0 #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release to npm | |
| # Fires when release-please publishes a GitHub Release — that only happens when a | |
| # release pull request is merged, which is itself a deliberate act with the version | |
| # and changelog visible for review. So merging the release PR is the single action | |
| # that ships a version. | |
| # | |
| # Still dispatchable by hand, defaulting to a dry run, for re-publishing after a | |
| # failure or validating the tarball without shipping. | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| inputs: | |
| dry_run: | |
| description: 'Pack and validate without publishing' | |
| type: boolean | |
| default: true | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # Required for OIDC — this is what npm exchanges for a short-lived | |
| # publish credential, and what provenance is derived from. Only works on a | |
| # public repository. | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| # 24 rather than 22: trusted publishing needs npm >= 11.5.1, and Node 22 | |
| # still ships npm 10.x. | |
| node-version: 24 | |
| cache: npm | |
| registry-url: https://registry.npmjs.org | |
| - name: Ensure an npm new enough for trusted publishing | |
| run: | | |
| npm install -g npm@^11 | |
| npm --version | |
| - run: npm ci | |
| - name: Typecheck | |
| run: npx tsc -p tsconfig.json --noEmit | |
| - name: Test | |
| run: npm test | |
| - name: Refuse to publish a version that already exists | |
| run: | | |
| NAME=$(node -p "require('./package.json').name") | |
| VERSION=$(node -p "require('./package.json').version") | |
| echo "Preparing $NAME@$VERSION" | |
| if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then | |
| echo "::error::$NAME@$VERSION is already published. Bump the version first." | |
| exit 1 | |
| fi | |
| - name: Check the README makes no false promises | |
| run: | | |
| if grep -q 'Not released yet' README.md; then | |
| echo "::error::README still carries the pre-release note. Remove it before publishing." | |
| exit 1 | |
| fi | |
| - name: Pack (dry run) | |
| if: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }} | |
| run: npm publish --dry-run | |
| # No NODE_AUTH_TOKEN. Publishing uses npm trusted publishing (OIDC): npm | |
| # verifies this workflow's identity against the trusted publisher configured | |
| # on the package, so there is no long-lived token to leak or rotate. npm's own | |
| # UI warns against automation tokens that bypass 2FA, and this is the | |
| # alternative it points at. | |
| # | |
| # Provenance is automatic under OIDC for a public package from a public repo, | |
| # so --provenance is not passed explicitly. | |
| # On a release event inputs.dry_run is undefined, so this must not rely on | |
| # negating it — an undefined input would otherwise read as "not a dry run" | |
| # by luck rather than intent. | |
| - name: Publish | |
| if: ${{ github.event_name == 'release' || !inputs.dry_run }} | |
| run: npm publish --access public | |
| # No tagging step: release-please already created the tag and the GitHub | |
| # Release that triggered this run. |