documentation #3746 [Toolkit] Add install disclaimer to README (kbond) #27
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release on NPM | |
| on: | |
| push: | |
| tags: | |
| - 'v3.*.*' | |
| permissions: | |
| id-token: write # Required for OIDC | |
| contents: read | |
| concurrency: | |
| group: release-on-npm-${{ github.ref_name }} | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.ref }} | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - name: Verify tag is on the matching release branch | |
| run: | | |
| set -euo pipefail | |
| MAJOR="${GITHUB_REF_NAME#v}" | |
| MAJOR="${MAJOR%%.*}" | |
| BRANCH="${MAJOR}.x" | |
| git fetch --no-tags origin "refs/heads/${BRANCH}:refs/remotes/origin/${BRANCH}" | |
| if ! git merge-base --is-ancestor "${GITHUB_SHA}" "refs/remotes/origin/${BRANCH}"; then | |
| echo "::error::Tag ${GITHUB_REF_NAME} (${GITHUB_SHA}) is not an ancestor of branch ${BRANCH}. Refusing to publish." | |
| exit 1 | |
| fi | |
| echo "Tag ${GITHUB_REF_NAME} verified as ancestor of ${BRANCH}." | |
| - run: npm i -g corepack && corepack enable | |
| # setup-node does not enable any package-manager cache here (no `cache:` input), | |
| # so cache poisoning is not a concern on this release workflow. | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # zizmor: ignore[cache-poisoning] v7.0.0 | |
| with: | |
| registry-url: 'https://registry.npmjs.org' | |
| node-version-file: '.nvmrc' | |
| # npm 11.5.1 or later is required for OIDC. Pinned explicitly to avoid | |
| # pulling a compromised "latest" at release time; bump via dedicated PR. | |
| - run: npm install -g npm@11.16.0 | |
| - name: Install root JS dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Build JS assets | |
| run: pnpm run build | |
| - name: Verify dist files match committed sources | |
| run: | | |
| if ! git diff --quiet; then | |
| echo "::error::Built dist files differ from the committed ones at tag ${GITHUB_REF_NAME}. Refusing to publish." | |
| git status --porcelain | |
| git diff | |
| exit 1 | |
| fi | |
| echo "Built dist files match the committed ones." | |
| - name: Publish on NPM | |
| run: pnpm publish --recursive --access public --no-git-checks --provenance |