crudy/pgmorbac-node
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: stage releases for 2FA approval instead of publishing them

Browse Source 
The npm trusted publisher may only stage, so a version goes live once a
maintainer approves it with 2FA. Staging needs npm 11.15 or later; Node 24.12
ships 11.6, so the job installs a pinned npm first.
This commit is contained in:
marc
2026-10-20 13:16:35 +02:00
parent 006900a963
commit 735bce774d
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/publish.yml
+8 -4
View File
@@ -1,8 +1,10 @@
# Publishes @crudy/pgmorbac to npmjs on version tags (v<major>.<minor>.<patch>) # Stages @crudy/pgmorbac to npmjs on version tags (v<major>.<minor>.<patch>)
# through npm trusted publishing: GitHub's OIDC token stands in for an npm # through npm trusted publishing: GitHub's OIDC token stands in for an npm
# token, and npm attaches a provenance statement naming this repository and # token, and npm attaches a provenance statement naming this repository and
# commit. The organisation only allows its own actions, so checkout and Node # commit. The trusted publisher may only stage: a staged version goes live once
# setup are plain shell. prepack downloads the signed crudylabs/pgmorbac # a maintainer approves it with 2FA (npm stage approve, or npmjs.com). The
# organisation only allows its own actions, so checkout and Node setup are
# plain shell. prepack downloads the signed crudylabs/pgmorbac
# release of the same version and verifies it, so that release must exist # release of the same version and verifies it, so that release must exist
# before this tag is pushed. # before this tag is pushed.
name: publish name: publish
@@ -37,6 +39,8 @@ jobs:
tar -xJf "$file" -C "$RUNNER_TEMP/node" --strip-components=1 tar -xJf "$file" -C "$RUNNER_TEMP/node" --strip-components=1
rm "$file" rm "$file"
echo "$RUNNER_TEMP/node/bin" >> "$GITHUB_PATH" echo "$RUNNER_TEMP/node/bin" >> "$GITHUB_PATH"
- name: Install npm with staged publishing
run: npm install -g npm@11.21.1
- run: npm install --no-audit --no-fund - run: npm install --no-audit --no-fund
- run: npm test - run: npm test
- name: Publish - name: Publish
@@ -47,5 +51,5 @@ jobs:
if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
echo "$NAME@$VERSION is already published" echo "$NAME@$VERSION is already published"
else else
npm publish --access public npm stage publish
fi fi