Merge pull request #19 from ar-io/ci/npm-trusted-publishing #45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| concurrency: | |
| group: ${{ github.workflow }} | |
| cancel-in-progress: true | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - alpha | |
| workflow_dispatch: | |
| jobs: | |
| build: | |
| uses: ./.github/workflows/build.yml | |
| secrets: inherit | |
| release: | |
| runs-on: ubuntu-latest | |
| needs: build | |
| permissions: | |
| contents: write # publish a GitHub release and push the release commit | |
| id-token: write # mint the OIDC token npm exchanges for a publish token | |
| issues: write # comment on released issues | |
| pull-requests: write # comment on released pull requests | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # @semantic-release/git pushes the `chore(release)` commit straight to | |
| # main, which the `two-stage` ruleset otherwise requires a PR for. | |
| # The GitHub Actions app (id 15368) is a bypass actor on that ruleset, | |
| # so the built-in token is sufficient — matching turbo-sdk, which runs | |
| # the same release with the plain GITHUB_TOKEN. No PAT to expire. | |
| # A push made with this token does not re-trigger workflows, and the | |
| # release commit carries [skip ci] regardless. | |
| token: ${{ github.token }} | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| registry-url: https://registry.npmjs.org | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Build package | |
| run: pnpm build | |
| # @semantic-release/npm prefers npm trusted publishing: it exchanges the | |
| # GitHub OIDC token above for a short-lived registry token, so no | |
| # long-lived npm credential is involved and the release carries a | |
| # provenance attestation. NODE_AUTH_TOKEN stays as the fallback — the | |
| # plugin only reaches for it when the OIDC exchange does not succeed, so | |
| # this is safe before the trusted publisher is registered on npmjs.com | |
| # and becomes dead weight once it is. | |
| - name: Release | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| HUSKY: '0' | |
| run: pnpm semantic-release |