Release #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| ios-version: | |
| description: 'iOS SDK release tag to bundle (e.g. 1.0.0)' | |
| required: true | |
| prerelease: | |
| description: 'Pre-release suffix for wrapper-only patches (blank for normal release)' | |
| required: false | |
| default: '' | |
| jobs: | |
| release: | |
| runs-on: macos-14 | |
| permissions: | |
| # contents: write — the job pushes the release commit/tag and creates a | |
| # GitHub release. id-token: write — lets `npm publish --provenance` mint a | |
| # Sigstore signing identity for the provenance attestation. | |
| contents: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Verify iOS release exists | |
| env: | |
| # onramper/onramper-ios is a separate private repo; the auto | |
| # GITHUB_TOKEN is scoped to THIS repo only and can't read it. | |
| # RELEASE_REPO_TOKEN is a fine-grained PAT (Contents: Read-only on | |
| # onramper-ios). Remove once onramper-ios is public. | |
| GH_TOKEN: ${{ secrets.RELEASE_REPO_TOKEN }} | |
| IOS_VERSION: ${{ github.event.inputs.ios-version }} | |
| run: | | |
| set -e | |
| curl -fsSL -o /dev/null \ | |
| -H "Authorization: token $GH_TOKEN" \ | |
| "https://api.github.com/repos/onramper/onramper-ios/releases/tags/v${IOS_VERSION}" \ | |
| || { echo "No iOS release for v${IOS_VERSION}"; exit 1; } | |
| - name: Compute target version | |
| id: ver | |
| env: | |
| BASE: ${{ github.event.inputs.ios-version }} | |
| PR: ${{ github.event.inputs.prerelease }} | |
| run: | | |
| if [ -z "$PR" ]; then | |
| echo "version=${BASE}" >> "$GITHUB_OUTPUT" | |
| echo "tag=latest" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "version=${BASE}-${PR}" >> "$GITHUB_OUTPUT" | |
| echo "tag=next" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Refuse if already published | |
| env: | |
| VERSION: ${{ steps.ver.outputs.version }} | |
| run: | | |
| if npm view "@onramper/onramper-react-native@${VERSION}" version 2>/dev/null; then | |
| echo "Version ${VERSION} already on npm."; exit 1 | |
| fi | |
| - name: Bump package.json | |
| env: | |
| VERSION: ${{ steps.ver.outputs.version }} | |
| run: | | |
| node -e "const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json'));p.version=process.env.VERSION;p.onramperSDK={checksum:'PENDING_FETCH'};fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\n');" | |
| - name: Fetch xcframework + checksum | |
| env: | |
| # Same cross-repo access as ci.yml: `gh release download` in | |
| # scripts/fetch-xcframework.js reads GH_TOKEN to reach onramper-ios. | |
| GH_TOKEN: ${{ secrets.RELEASE_REPO_TOKEN }} | |
| run: npm ci && npm run fetch-xcframework | |
| - name: Verify checksum recorded | |
| run: npm run verify-version | |
| - name: Slim xcframework for npm | |
| run: npm run slim-xcframework | |
| - name: Test + build | |
| run: | | |
| npm run lint | |
| npm run typecheck | |
| npx jest | |
| npm run build | |
| - name: Configure git | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| - name: Commit + tag | |
| env: | |
| VERSION: ${{ steps.ver.outputs.version }} | |
| run: | | |
| git add package.json | |
| # package.json may already be at the target version/checksum (e.g. it | |
| # was pre-populated on master), in which case there is nothing to | |
| # commit — that's fine. The tag is what the publish + podspec git | |
| # source need, so always create and push it. | |
| if git diff --cached --quiet; then | |
| echo "package.json already at v${VERSION} with recorded checksum; nothing to commit." | |
| else | |
| git commit -m "chore(release): v${VERSION}" | |
| git push origin master | |
| fi | |
| # Idempotent: a prior run that failed at publish may have already | |
| # created/pushed the tag. Skip if it exists (HEAD is unchanged in the | |
| # nothing-to-commit path, so the existing tag is correct). | |
| if git ls-remote --exit-code --tags origin "v${VERSION}" >/dev/null 2>&1; then | |
| echo "tag v${VERSION} already exists on origin; skipping." | |
| else | |
| git tag "v${VERSION}" | |
| git push origin "v${VERSION}" | |
| fi | |
| - name: Publish to npm | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| NPM_TAG: ${{ steps.ver.outputs.tag }} | |
| run: npm publish --tag "$NPM_TAG" --access public --provenance | |
| - name: Create GitHub release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| VERSION: ${{ steps.ver.outputs.version }} | |
| IOS_VERSION: ${{ github.event.inputs.ios-version }} | |
| run: | | |
| gh release create "v${VERSION}" \ | |
| --title "v${VERSION}" \ | |
| --notes "Bundles OnramperSDK ${IOS_VERSION}." |