Repository navigation
113 lines (113 loc) · 4.04 KB
/
Copy pathrelease.yml
File metadata and controls
113 lines (113 loc) · 4.04 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
name: publish tagged version
on:
push:
tags: ['v*']
workflow_dispatch:
concurrency:
group: capability-graph-release
cancel-in-progress: false
permissions:
contents: read
jobs:
preflight:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
- uses: actions/setup-node@v7
with:
node-version: '24'
- run: node scripts/check-release.mjs
env:
CG_RELEASE_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && 'true' || 'false' }}
validate:
needs: preflight
uses: ./.github/workflows/ci.yml
validate-docs:
needs: preflight
uses: ./.github/workflows/docs.yml
package:
needs: [validate, validate-docs]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v7
with:
node-version: '24'
cache: npm
- run: npm ci --ignore-scripts --no-audit --no-fund
- name: Build and test the release archive in an independent consumer
run: npm run smoke:package
env:
CG_ARTIFACTS_DIR: ${{ runner.temp }}/package-check
CG_RELEASE_DIR: ${{ runner.temp }}/release
- name: Check registry identity without publishing
run: node scripts/release-registry.mjs plan "$RUNNER_TEMP/release/"*.tgz
- uses: actions/upload-artifact@v6
with:
name: npm-package
path: ${{ runner.temp }}/release
if-no-files-found: error
publish:
if: github.event_name == 'push' && github.ref_type == 'tag'
needs: package
runs-on: ubuntu-latest
environment: npm-production
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v7
with:
node-version: '24'
package-manager-cache: false
- uses: actions/download-artifact@v7
with:
name: npm-package
path: ${{ runner.temp }}/release
- name: Resume only when existing registry bytes match
id: registry
run: node scripts/release-registry.mjs plan "$RUNNER_TEMP/release/"*.tgz
- name: Publish exactly the verified archive
if: steps.registry.outputs.publish == 'true'
run: npm publish "$RUNNER_TEMP/release/"*.tgz --registry=https://registry.npmjs.org/ --access public --tag latest --provenance
- name: Verify registry bytes and exact/default installation
run: node scripts/release-registry.mjs verify "$RUNNER_TEMP/release/"*.tgz
env:
CG_RELEASE_VERIFY_DIR: ${{ runner.temp }}/registry-verification
- uses: actions/upload-artifact@v6
if: always()
with:
name: npm-registry-verification
path: ${{ runner.temp }}/registry-verification/registry-verification.json
if-no-files-found: warn
release:
needs: publish
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
- uses: actions/setup-node@v7
with:
node-version: '24'
- uses: actions/download-artifact@v7
with:
name: npm-package
path: ${{ runner.temp }}/release
- name: Create or resume the tagged GitHub Release
env:
GH_TOKEN: ${{ github.token }}
RELEASE_TAG: ${{ github.ref_name }}
run: |
node scripts/check-release.mjs --notes > "$RUNNER_TEMP/release-notes.md"
if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
gh release edit "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --notes-file "$RUNNER_TEMP/release-notes.md"
gh release upload "$RELEASE_TAG" "$RUNNER_TEMP/release/"*.tgz "$RUNNER_TEMP/release/SHA256SUMS" --repo "$GITHUB_REPOSITORY" --clobber
else
gh release create "$RELEASE_TAG" "$RUNNER_TEMP/release/"*.tgz "$RUNNER_TEMP/release/SHA256SUMS" --repo "$GITHUB_REPOSITORY" --verify-tag --title "$RELEASE_TAG" --notes-file "$RUNNER_TEMP/release-notes.md"
fi