v4.0.1 #82
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to npm on release | |
| on: | |
| release: | |
| types: [published] | |
| jobs: | |
| release-package: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout release tag | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.sha }} | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Activate pnpm | |
| run: | | |
| corepack enable | |
| corepack prepare pnpm@11.0.0 --activate | |
| - name: Assert release ref, tag, and commit match | |
| env: | |
| RELEASE_TAG: ${{ github.event.release.tag_name }} | |
| run: | | |
| if [ -z "$RELEASE_TAG" ]; then | |
| echo "Release tag is empty." >&2 | |
| exit 1 | |
| fi | |
| if [ "$GITHUB_REF" != "refs/tags/$RELEASE_TAG" ]; then | |
| echo "Expected GITHUB_REF=refs/tags/$RELEASE_TAG, received $GITHUB_REF" >&2 | |
| exit 1 | |
| fi | |
| CHECKED_OUT_SHA="$(git rev-parse HEAD)" | |
| TAG_SHA="$(git rev-parse "$RELEASE_TAG^{commit}")" | |
| if [ "$CHECKED_OUT_SHA" != "$GITHUB_SHA" ] || [ "$TAG_SHA" != "$GITHUB_SHA" ]; then | |
| echo "Release tag, event SHA, and checked-out commit do not match." >&2 | |
| exit 1 | |
| fi | |
| - name: Sync package version from release tag | |
| env: | |
| RELEASE_TAG: ${{ github.event.release.tag_name }} | |
| run: | | |
| VERSION="${RELEASE_TAG#v}" | |
| echo "Setting package.json version to $VERSION (from tag $RELEASE_TAG)" | |
| pnpm version "$VERSION" --no-git-tag-version --allow-same-version | |
| pnpm install --lockfile-only | |
| - name: Verify package version matches release tag | |
| run: pnpm run verify:release-version | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Check formatting | |
| run: pnpm run format:check | |
| - name: Verify TypeScript version | |
| run: pnpm run verify:typescript-version | |
| - name: Verify v4 history privacy | |
| run: pnpm run verify:v4-history | |
| - name: Typecheck | |
| run: pnpm run typecheck | |
| - name: Build | |
| run: pnpm run build | |
| - name: Test | |
| run: pnpm test | |
| - name: Verify four-surface parity | |
| run: pnpm run test:four-surfaces | |
| - name: Pack and audit the release artifact once | |
| run: pnpm run pack:release-package package-artifacts | |
| - name: Upload exact release artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: release-package | |
| path: package-artifacts/* | |
| if-no-files-found: error | |
| runtime-smoke: | |
| runs-on: ubuntu-latest | |
| needs: release-package | |
| strategy: | |
| matrix: | |
| node-version: [22.x, 24.x] | |
| steps: | |
| - name: Checkout smoke scripts | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.sha }} | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| - name: Download exact release artifact | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: release-package | |
| path: package-artifacts | |
| - name: Smoke exact release artifact on Node ${{ matrix.node-version }} | |
| run: node scripts/smoke-packed-package.mjs package-artifacts | |
| publish: | |
| runs-on: ubuntu-latest | |
| needs: [release-package, runtime-smoke] | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout artifact verifier | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.sha }} | |
| - name: Setup Node.js 24 for npm | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| registry-url: https://registry.npmjs.org/ | |
| - name: Download exact release artifact | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: release-package | |
| path: package-artifacts | |
| - name: Verify and publish exact release artifact | |
| run: | | |
| node scripts/verify-release-artifact.mjs package-artifacts | |
| TARBALLS=(package-artifacts/*.tgz) | |
| if [ "${#TARBALLS[@]}" -ne 1 ]; then | |
| echo "Expected exactly one release tarball." >&2 | |
| exit 1 | |
| fi | |
| npm publish "./${TARBALLS[0]}" --access public --provenance --ignore-scripts | |
| backfill-version: | |
| runs-on: ubuntu-latest | |
| needs: publish | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout release tag | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.sha }} | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Activate pnpm | |
| run: | | |
| corepack enable | |
| corepack prepare pnpm@11.0.0 --activate | |
| - name: Sync and verify version for repository backfill | |
| env: | |
| RELEASE_TAG: ${{ github.event.release.tag_name }} | |
| run: | | |
| if [ "$GITHUB_REF" != "refs/tags/$RELEASE_TAG" ]; then | |
| echo "Expected GITHUB_REF=refs/tags/$RELEASE_TAG, received $GITHUB_REF" >&2 | |
| exit 1 | |
| fi | |
| VERSION="${RELEASE_TAG#v}" | |
| pnpm version "$VERSION" --no-git-tag-version --allow-same-version | |
| pnpm install --lockfile-only | |
| pnpm run verify:release-version | |
| - name: Commit synced version back to repository | |
| env: | |
| RELEASE_TAG: ${{ github.event.release.tag_name }} | |
| TARGET_BRANCH: ${{ github.event.release.target_commitish }} | |
| DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} | |
| run: | | |
| if git diff --quiet -- package.json pnpm-lock.yaml; then | |
| echo "No package version file changes to commit." | |
| exit 0 | |
| fi | |
| VERSION="${RELEASE_TAG#v}" | |
| BRANCH="${TARGET_BRANCH:-$DEFAULT_BRANCH}" | |
| if ! git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then | |
| echo "Target '$BRANCH' is not a remote branch; falling back to '$DEFAULT_BRANCH'." | |
| BRANCH="$DEFAULT_BRANCH" | |
| fi | |
| echo "Committing synced package version to branch '$BRANCH'" | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add package.json pnpm-lock.yaml | |
| git commit -m "chore(release): sync package version to ${VERSION}" | |
| git fetch origin "$BRANCH" | |
| git rebase "origin/$BRANCH" | |
| git push origin HEAD:"$BRANCH" | |
| - name: Verify committed sync reached remote branch | |
| env: | |
| RELEASE_TAG: ${{ github.event.release.tag_name }} | |
| TARGET_BRANCH: ${{ github.event.release.target_commitish }} | |
| DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} | |
| run: | | |
| BRANCH="${TARGET_BRANCH:-$DEFAULT_BRANCH}" | |
| if ! git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then | |
| BRANCH="$DEFAULT_BRANCH" | |
| fi | |
| VERSION="${RELEASE_TAG#v}" | |
| git fetch origin "$BRANCH" | |
| REMOTE_VERSION="$(git show "origin/$BRANCH:package.json" | node -e "process.stdin.setEncoding('utf8'); let d=''; process.stdin.on('data', c => d += c); process.stdin.on('end', () => console.log(JSON.parse(d).version || ''));")" | |
| if [ "$REMOTE_VERSION" != "$VERSION" ]; then | |
| echo "Remote branch $BRANCH package.json version is '$REMOTE_VERSION', expected '$VERSION'" >&2 | |
| exit 1 | |
| fi | |
| echo "Remote branch $BRANCH package.json version matches release tag $RELEASE_TAG" |