marc
ee15ee0adf
The npm trusted publisher may only stage, so a version goes live once a maintainer approves it with 2FA. Staging needs npm 11.15 or later; Node 24.12 ships 11.6, so the job installs a pinned npm first.
54 lines
2.1 KiB
YAML
54 lines
2.1 KiB
YAML
# Stages @crudy/pgmorbac-fastify to npmjs on version tags (v<major>.<minor>.<patch>)
|
|
# through npm trusted publishing: GitHub's OIDC token stands in for an npm
|
|
# token, and npm attaches a provenance statement naming this repository and
|
|
# commit. The trusted publisher may only stage: a staged version goes live once
|
|
# a maintainer approves it with 2FA (npm stage approve, or npmjs.com). The
|
|
# organisation only allows its own actions, so checkout and Node setup are
|
|
# plain shell. prepack builds dist from src.
|
|
name: publish
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
NODE_VERSION: v24.12.0
|
|
steps:
|
|
- name: Check out the tag
|
|
run: |
|
|
case "$GITHUB_REF_NAME" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "not a version tag: $GITHUB_REF_NAME" >&2; exit 1 ;; esac
|
|
git init -q .
|
|
git fetch -q --depth 1 "https://github.com/$GITHUB_REPOSITORY" "refs/tags/$GITHUB_REF_NAME:refs/tags/$GITHUB_REF_NAME"
|
|
git checkout -q "refs/tags/$GITHUB_REF_NAME"
|
|
- name: Install Node
|
|
run: |
|
|
base="https://nodejs.org/dist/$NODE_VERSION"
|
|
file="node-$NODE_VERSION-linux-x64.tar.xz"
|
|
curl -fsSLO "$base/$file"
|
|
curl -fsSL "$base/SHASUMS256.txt" | grep " $file\$" | sha256sum -c -
|
|
mkdir -p "$RUNNER_TEMP/node"
|
|
tar -xJf "$file" -C "$RUNNER_TEMP/node" --strip-components=1
|
|
rm "$file"
|
|
echo "$RUNNER_TEMP/node/bin" >> "$GITHUB_PATH"
|
|
- name: Install npm with staged publishing
|
|
run: npm install -g npm@11.21.1
|
|
- run: npm install --no-audit --no-fund
|
|
- run: npm run check
|
|
- name: Publish
|
|
run: |
|
|
VERSION=$(node -p "require('./package.json').version")
|
|
[ "v$VERSION" = "$GITHUB_REF_NAME" ] || { echo "tag $GITHUB_REF_NAME does not match package version $VERSION" >&2; exit 1; }
|
|
NAME=$(node -p "require('./package.json').name")
|
|
if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
|
|
echo "$NAME@$VERSION is already published"
|
|
else
|
|
npm stage publish
|
|
fi
|