feat(cli): ASP_AGENT env var override; clean stale credentials on res… #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: cli publish | |
| on: | |
| push: | |
| tags: | |
| - "cli-v*" | |
| permissions: | |
| contents: write # create GitHub Release | |
| id-token: write # npm provenance + Trusted Publishing via OIDC | |
| jobs: | |
| publish: | |
| name: publish to npm | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: cli | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "24" | |
| registry-url: "https://registry.npmjs.org" | |
| cache: npm | |
| cache-dependency-path: cli/package-lock.json | |
| - name: Verify tag matches package.json version | |
| run: | | |
| PKG_VERSION=$(jq -r .version package.json) | |
| TAG_VERSION="${GITHUB_REF_NAME#cli-v}" | |
| if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then | |
| echo "::error::Tag cli-v$TAG_VERSION does not match cli/package.json version $PKG_VERSION" | |
| exit 1 | |
| fi | |
| - run: npm ci | |
| - run: npm run typecheck | |
| - run: npm test | |
| - run: npm run build | |
| - name: Publish to npm with provenance (Trusted Publishing via OIDC) | |
| run: npm publish --provenance | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| generate_release_notes: true | |
| draft: false | |
| # `prerelease` defaults to false. We can't compute it from | |
| # github.ref_name here because the `cli-v` prefix always contains a | |
| # hyphen, and GitHub Actions expressions have no replace() function. | |
| # If a prerelease is needed, mark it in the GitHub UI after the run. | |
| bump-homebrew: | |
| name: bump homebrew tap | |
| needs: publish | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Prerelease tags like cli-v0.1.0-rc.1 have a hyphen in the version | |
| # portion (after the cli-v prefix). We can't gate this in the job-level | |
| # `if:` because GitHub Actions expressions have no string-replace | |
| # function — checking for `-` in github.ref_name would always match | |
| # the cli-v prefix. So we compute is_prerelease in a shell step and | |
| # gate every subsequent step on its output. | |
| - name: Detect prerelease | |
| id: detect | |
| env: | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| VERSION="${REF_NAME#cli-v}" | |
| if [[ "$VERSION" == *-* ]]; then | |
| echo "is_prerelease=true" >> "$GITHUB_OUTPUT" | |
| echo "Prerelease detected ($VERSION); homebrew bump will be skipped." | |
| else | |
| echo "is_prerelease=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Wait for npm registry to propagate | |
| if: steps.detect.outputs.is_prerelease == 'false' | |
| run: sleep 30 | |
| - name: Update Homebrew tap formula | |
| if: steps.detect.outputs.is_prerelease == 'false' | |
| env: | |
| TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| VERSION="${REF_NAME#cli-v}" | |
| TARBALL_URL="https://registry.npmjs.org/@robotnetworks/asp/-/asp-${VERSION}.tgz" | |
| SHA256=$(curl -sSL "$TARBALL_URL" | shasum -a 256 | cut -d' ' -f1) | |
| echo "Version: $VERSION" | |
| echo "Tarball: $TARBALL_URL" | |
| echo "sha256: $SHA256" | |
| git clone "https://x-access-token:${TAP_TOKEN}@github.com/RobotNetworks/homebrew-tap.git" tap | |
| cd tap | |
| sed -i "s|url \".*\"|url \"${TARBALL_URL}\"|" Formula/asp.rb | |
| sed -i "s|sha256 \".*\"|sha256 \"${SHA256}\"|" Formula/asp.rb | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add Formula/asp.rb | |
| git diff --cached --quiet && { echo "No formula changes, skipping commit."; exit 0; } | |
| git commit -m "asp ${VERSION}" | |
| git push |