release: 0.12.2 (#60) #28
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish npm | |
| on: | |
| push: | |
| tags: | |
| - 'v*.*.*' | |
| permissions: {} | |
| concurrency: | |
| group: npm-release-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| name: Publish Package | |
| if: github.repository == 'Xquik-dev/x-twitter-scraper-typescript' | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| environment: npm | |
| permissions: | |
| artifact-metadata: write | |
| attestations: write | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Check out the release tag | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: '24.18.0' | |
| registry-url: 'https://registry.npmjs.org' | |
| package-manager-cache: false | |
| - name: Set up pnpm | |
| uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| with: | |
| version: '11.15.1' | |
| run_install: false | |
| - name: Verify release context | |
| env: | |
| DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} | |
| EXPECTED_PACKAGE_NAME: x-twitter-scraper | |
| run: .github/scripts/verify-release-context.sh | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Audit dependencies | |
| run: pnpm audit --audit-level high | |
| - name: Check types and formatting | |
| run: pnpm lint | |
| - name: Run tests | |
| run: pnpm test | |
| - name: Verify reproducible package | |
| run: pnpm run check:reproducible | |
| - name: Build and inspect the package | |
| run: bash ./bin/prepare-npm-release | |
| - name: Pack the release artifact | |
| id: package | |
| working-directory: dist | |
| run: | | |
| set -euo pipefail | |
| package_name="$(jq -r -e '.name' package.json)" | |
| package_version="$(jq -r -e '.version' package.json)" | |
| package_file="$(npm pack --json --pack-destination "$RUNNER_TEMP" | jq -r -e '.[0].filename')" | |
| package_path="$RUNNER_TEMP/$package_file" | |
| test -f "$package_path" | |
| { | |
| echo "name=$package_name" | |
| echo "version=$package_version" | |
| echo "path=$package_path" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Attest the release artifact | |
| uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 | |
| with: | |
| subject-path: ${{ steps.package.outputs.path }} | |
| - name: Export the signed provenance | |
| id: provenance | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| PACKAGE_PATH: ${{ steps.package.outputs.path }} | |
| run: | | |
| set -euo pipefail | |
| provenance_directory="$RUNNER_TEMP/provenance" | |
| mkdir -p "$provenance_directory" | |
| ( | |
| cd "$provenance_directory" | |
| gh attestation download "$PACKAGE_PATH" --repo "$GITHUB_REPOSITORY" | |
| ) | |
| provenance_source="$(find "$provenance_directory" -maxdepth 1 -type f -name 'sha256*.jsonl' -print -quit)" | |
| test -n "$provenance_source" | |
| provenance_path="${PACKAGE_PATH}.intoto.jsonl" | |
| cp "$provenance_source" "$provenance_path" | |
| echo "path=$provenance_path" >> "$GITHUB_OUTPUT" | |
| - name: Publish to npm | |
| env: | |
| PACKAGE_NAME: ${{ steps.package.outputs.name }} | |
| PACKAGE_PATH: ${{ steps.package.outputs.path }} | |
| PACKAGE_VERSION: ${{ steps.package.outputs.version }} | |
| run: | | |
| set -euo pipefail | |
| published_version="$(npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" version 2>/dev/null || true)" | |
| if [[ -n "$published_version" ]]; then | |
| if [[ "$published_version" != "$PACKAGE_VERSION" ]]; then | |
| echo "Registry version mismatch. Check the package version." >&2 | |
| exit 1 | |
| fi | |
| echo "${PACKAGE_NAME}@${PACKAGE_VERSION} is already published." | |
| exit 0 | |
| fi | |
| npm publish "$PACKAGE_PATH" --access public --provenance --tag latest | |
| - name: Stage signed release assets | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: signed-release-assets | |
| path: | | |
| ${{ steps.package.outputs.path }} | |
| ${{ steps.provenance.outputs.path }} | |
| if-no-files-found: error | |
| retention-days: 1 | |
| release-assets: | |
| name: Publish Release Assets | |
| needs: publish | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| permissions: | |
| actions: read | |
| contents: write | |
| steps: | |
| - name: Download signed release assets | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: signed-release-assets | |
| path: signed-release-assets | |
| - name: Publish signed release assets | |
| env: | |
| GH_REPO: ${{ github.repository }} | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| mapfile -t assets < <(find signed-release-assets -maxdepth 1 -type f -print) | |
| if [[ "${#assets[@]}" -ne 2 ]]; then | |
| echo "Release asset count is wrong. Upload one package and one provenance file." >&2 | |
| exit 1 | |
| fi | |
| gh release upload "$GITHUB_REF_NAME" "${assets[@]}" --clobber |