docs: cover the SPA fallback and correct the release process (#25) #51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| concurrency: | |
| group: ${{ github.workflow }} | |
| cancel-in-progress: true | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - alpha | |
| workflow_dispatch: | |
| jobs: | |
| build: | |
| uses: ./.github/workflows/build.yml | |
| secrets: inherit | |
| release: | |
| runs-on: ubuntu-latest | |
| needs: build | |
| permissions: | |
| contents: write # publish a GitHub release and push the release commit | |
| id-token: write # mint the OIDC token npm exchanges for a publish token | |
| issues: write # comment on released issues | |
| pull-requests: write # comment on released pull requests | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| # semantic-release pushes only the version tag, and the `two-stage` | |
| # ruleset covers refs/heads/main, not refs/tags — so the built-in | |
| # token is enough and no personal credential is involved. Nothing | |
| # here writes to main: @semantic-release/git was removed precisely | |
| # because the Actions app cannot be granted a ruleset bypass | |
| # ("must be part of the ruleset source or owner organization"). | |
| token: ${{ github.token }} | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v5 | |
| with: | |
| version: 10 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: '22' | |
| registry-url: https://registry.npmjs.org | |
| cache: 'pnpm' | |
| # npm itself performs the OIDC token exchange for trusted publishing; | |
| # @semantic-release/npm only verifies that the exchange is possible and | |
| # then deliberately writes no auth to .npmrc. The npm bundled with Node | |
| # 22 is 10.x, which predates that support, so `npm publish` runs with no | |
| # credentials at all and fails with ENEEDAUTH. Trusted publishing landed | |
| # in npm 11.5.1. | |
| - name: Use an npm that supports trusted publishing | |
| run: | | |
| npm install -g npm@^11.5.1 | |
| npm --version | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Build package | |
| run: pnpm build | |
| # Publishing goes over npm trusted publishing: npm exchanges the GitHub | |
| # OIDC token above for a short-lived registry token, so the release | |
| # carries a provenance attestation and no long-lived npm credential | |
| # exists to expire. The NPM_TOKEN fallback was removed once a release | |
| # succeeded over OIDC — a stale token that cannot be verified is worse | |
| # than no fallback, because it reads as one. | |
| - name: Release | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| HUSKY: '0' | |
| run: pnpm semantic-release |