CI #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Tests every change and publishes to npm when a release is published. | |
| # | |
| # Cutting a release: | |
| # npm version patch && git push && git push --tags | |
| # gh release create v1.4.2 --generate-notes | |
| # | |
| # The release is what publishes. Downstream worker images pick the new version | |
| # up through Renovate pull requests in their own repositories. | |
| # | |
| # Publishing uses npm trusted publishing, so there is no npm token anywhere. | |
| # npmjs.com must list this repository and this workflow file as the package's | |
| # trusted publisher; if that entry is edited, publishing here stops working. | |
| name: CI | |
| on: | |
| push: | |
| branches: [ master ] | |
| pull_request: | |
| branches: [ master ] | |
| release: | |
| types: [ published ] | |
| workflow_dispatch: | |
| inputs: | |
| dry_run: | |
| description: 'Run npm publish --dry-run instead of publishing' | |
| type: boolean | |
| default: true | |
| jobs: | |
| test: | |
| runs-on: ubuntu-22.04 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # The versions this actually runs on: soykb-worker is node 18, the | |
| # 1000genome and Montage workers are node 20. Testing only on a newer | |
| # release would validate an environment no worker uses. | |
| node-version: [ '18', '20' ] | |
| name: test (node ${{ matrix.node-version }}) | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| # No install step: connector.test.js reaches only connector.js and | |
| # consoleLogger.js, neither of which requires a dependency. | |
| - name: Completion-transport tests | |
| run: node tests/connector.test.js | |
| publish: | |
| needs: [ test ] | |
| if: github.event_name == 'release' || github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| # Lets npm exchange a GitHub OIDC identity for publish rights. This is | |
| # what replaces a stored npm token; see "Releasing" in the README. | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Publishing is tooling, so this tracks a current node rather than the | |
| # node the workers run. It ships an npm new enough to publish over OIDC, | |
| # which needs 11.5.1; node 20 ships npm 10 and cannot install a current | |
| # npm at all. | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '24' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Check npm is new enough to publish via OIDC | |
| run: | | |
| node -e ' | |
| const v = require("child_process").execSync("npm --version").toString().trim(); | |
| const [a, b, c] = v.split(".").map(Number); | |
| if (a < 11 || (a === 11 && (b < 5 || (b === 5 && c < 1)))) { | |
| console.error("npm " + v + " cannot use trusted publishing, need 11.5.1 or newer"); | |
| process.exit(1); | |
| } | |
| console.log("npm " + v + " supports trusted publishing"); | |
| ' | |
| - name: Release tag must match the version in package.json | |
| if: github.event_name == 'release' | |
| run: | | |
| pkg="v$(node -p "require('./package.json').version")" | |
| echo "package.json=$pkg tag=$GITHUB_REF_NAME" | |
| test "$pkg" = "$GITHUB_REF_NAME" | |
| - name: Refuse to republish a version already on npm | |
| if: github.event_name == 'release' | |
| run: | | |
| v=$(node -p "require('./package.json').version") | |
| if npm view "@hyperflow/job-executor@$v" version >/dev/null 2>&1; then | |
| echo "@hyperflow/job-executor@$v is already published" | |
| exit 1 | |
| fi | |
| # No token: npm authenticates through the OIDC identity granted above, and | |
| # attaches a provenance attestation automatically. | |
| - name: Publish | |
| run: npm publish ${{ (github.event_name == 'workflow_dispatch' && inputs.dry_run) && '--dry-run' || '' }} |