chore(release): 0.3.2 — publish @anyq/cloudflare-queues (#12) #5
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| on: | |
| push: | |
| tags: ["v*"] | |
| permissions: | |
| contents: write | |
| id-token: write | |
| attestations: write | |
| jobs: | |
| compliance: | |
| uses: ./.github/workflows/compliance.yml | |
| publish: | |
| needs: compliance | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Build | |
| run: bun run build | |
| - name: Install Doppler CLI | |
| uses: dopplerhq/cli-action@v3 | |
| - name: Configure registry auth | |
| env: | |
| DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }} | |
| run: | | |
| cat > /tmp/configure-registry-auth.sh <<'SCRIPT' | |
| if [ -z "$NPM_TOKEN" ]; then | |
| echo "::error::NPM_TOKEN could not be resolved from Doppler. Verify the DOPPLER_TOKEN secret is set and the release-tooling/prd config contains NPM_TOKEN." | |
| exit 1 | |
| fi | |
| # npm reads ~/.npmrc (used by the whoami preflight and `npm view`). | |
| echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc | |
| # bun publish does NOT reliably read ~/.npmrc in this version; it | |
| # authenticates via bunfig.toml [install.registry]. Append it to the | |
| # project bunfig.toml so it is found when publishing from each package | |
| # dir. The literal "$NPM_TOKEN" is expanded by bun from the env at | |
| # publish time, so the token is never written to disk. | |
| { | |
| echo "" | |
| echo "[install.registry]" | |
| echo 'url = "https://registry.npmjs.org"' | |
| echo 'token = "$NPM_TOKEN"' | |
| } >> bunfig.toml | |
| SCRIPT | |
| doppler run -- bash /tmp/configure-registry-auth.sh | |
| - name: Verify npm authentication | |
| env: | |
| DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }} | |
| run: | | |
| cat > /tmp/verify-npm-auth.sh <<'SCRIPT' | |
| # Early structural check on the token. Note: this validates the npm | |
| # auth path; bun's path is validated by the publish step itself, which | |
| # now fails the job loudly on any error. | |
| if ! npm whoami >/dev/null 2>&1; then | |
| echo "::error::npm authentication failed. NPM_TOKEN (sourced from Doppler via DOPPLER_TOKEN, config release-tooling/prd) is missing, expired, or lacks publish rights to the @anyq scope." | |
| exit 1 | |
| fi | |
| echo "Authenticated to npm as: $(npm whoami)" | |
| SCRIPT | |
| doppler run -- bash /tmp/verify-npm-auth.sh | |
| - name: Publish all packages | |
| env: | |
| DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }} | |
| run: | | |
| cat > /tmp/publish-packages.sh <<'SCRIPT' | |
| set -uo pipefail | |
| PACKAGES=( | |
| core | |
| memory | |
| redis-streams | |
| rabbitmq | |
| sqs | |
| sns | |
| google-pubsub | |
| kafka | |
| nats | |
| azure-servicebus | |
| cloudflare-queues | |
| ) | |
| published=() | |
| skipped=() | |
| failed=() | |
| for pkg in "${PACKAGES[@]}"; do | |
| name="@anyq/$pkg" | |
| version="$(node -p "require('./packages/$pkg/package.json').version")" | |
| # Idempotent: skip versions already on the registry so re-running a | |
| # tag does not hard-fail on packages that already published. | |
| if npm view "${name}@${version}" version >/dev/null 2>&1; then | |
| echo "Skipping ${name}@${version} (already on npm)" | |
| skipped+=("${name}@${version}") | |
| continue | |
| fi | |
| echo "Publishing ${name}@${version}..." | |
| if ( cd "packages/$pkg" && bun publish --access public --no-git-checks ); then | |
| published+=("${name}@${version}") | |
| else | |
| echo "::error::Failed to publish ${name}@${version}" | |
| failed+=("${name}@${version}") | |
| fi | |
| done | |
| { | |
| echo "## Publish results" | |
| echo "" | |
| echo "### Published (${#published[@]})" | |
| for p in "${published[@]:-}"; do [ -n "$p" ] && echo "- \`$p\`"; done | |
| echo "" | |
| echo "### Skipped, already on npm (${#skipped[@]})" | |
| for p in "${skipped[@]:-}"; do [ -n "$p" ] && echo "- \`$p\`"; done | |
| echo "" | |
| echo "### Failed (${#failed[@]})" | |
| for p in "${failed[@]:-}"; do [ -n "$p" ] && echo "- \`$p\`"; done | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| # Any real failure fails the job so a green check means a real release. | |
| if [ "${#failed[@]}" -gt 0 ]; then | |
| echo "::error::${#failed[@]} package(s) failed to publish: ${failed[*]}" | |
| exit 1 | |
| fi | |
| SCRIPT | |
| doppler run -- bash /tmp/publish-packages.sh |