Skip to content

Commit 7dd4c27

Browse files
scolladonscolladon
committed
build: configure release as trusted publisher (#165)
1 parent 3367b2f commit 7dd4c27

12 files changed

+787
-1428
lines changed

‎.github/actions/install/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ runs:
1010
run: echo "dir=$(npm config get cache)" >> "$GITHUB_OUTPUT"
1111
shell: bash
1212

13-
- uses: actions/cache@v4
13+
- uses: actions/cache@v5
1414
with:
1515
path: ${{ steps.cache-dir.outputs.dir }}
1616
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}

‎.github/workflows/manual-deprecate-versions.yml‎

Lines changed: 0 additions & 31 deletions
This file was deleted.

‎.github/workflows/manual-manage-versions.yml‎

Lines changed: 0 additions & 37 deletions
This file was deleted.

‎.github/workflows/npm-service.yml‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
---
2+
name: NPM Service
3+
4+
on:
5+
release:
6+
types: [published]
7+
pull_request:
8+
branches: [main]
9+
types: [opened, synchronize, reopened, closed]
10+
paths-ignore:
11+
- "**.md"
12+
workflow_dispatch:
13+
inputs:
14+
version-alias:
15+
description: version alias to map to a version number
16+
required: true
17+
type: choice
18+
options:
19+
- stable
20+
- latest
21+
- latest-rc
22+
version-number:
23+
description: version number (semver format)
24+
required: true
25+
default: vX.Y.Z
26+
type: string
27+
28+
permissions:
29+
contents: read
30+
id-token: write
31+
32+
# Manage concurrency to stop running jobs and start new ones in case of new commit pushed
33+
concurrency:
34+
group: ${{ github.ref }}-${{ github.workflow }}
35+
cancel-in-progress: true
36+
37+
jobs:
38+
publish:
39+
if: github.event_name == 'release' || (github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' && github.event.pull_request.merged == false)
40+
runs-on: ubuntu-latest
41+
outputs:
42+
channel: ${{ steps.publish.outputs.channel }}
43+
permissions:
44+
id-token: write
45+
contents: read
46+
pull-requests: write
47+
steps:
48+
- uses: actions/checkout@v6
49+
- uses: actions/setup-node@v6
50+
with:
51+
node-version: 20
52+
registry-url: "https://registry.npmjs.org"
53+
- run: npm install -g npm@latest
54+
- uses: ./.github/actions/install
55+
56+
# Dev version setup (PR only)
57+
- name: Compute dev version
58+
if: github.event_name == 'pull_request'
59+
id: version
60+
run: |
61+
CURRENT_VERSION=$(jq -r '.version' package.json)
62+
DEV_CHANNEL="dev-${{ github.event.pull_request.number }}"
63+
DEV_VERSION="${CURRENT_VERSION}-${DEV_CHANNEL}.${{ github.run_id }}-${{ github.run_attempt }}"
64+
echo "channel=$DEV_CHANNEL" >> "$GITHUB_OUTPUT"
65+
echo "version=$DEV_VERSION" >> "$GITHUB_OUTPUT"
66+
67+
- name: Set dev version
68+
if: github.event_name == 'pull_request'
69+
env:
70+
DEV_CHANNEL: ${{ steps.version.outputs.channel }}
71+
run: |
72+
git config --global user.email "${DEV_CHANNEL}@github.com"
73+
git config --global user.name "$DEV_CHANNEL"
74+
npm version "${{ steps.version.outputs.version }}" --no-git-tag-version
75+
76+
# Publish (unified with conditional channel)
77+
- name: Publish
78+
id: publish
79+
env:
80+
DEV_CHANNEL: ${{ steps.version.outputs.channel }}
81+
RELEASE_TAG: ${{ github.event.release.tag_name }}
82+
EVENT_NAME: ${{ github.event_name }}
83+
run: |
84+
if [ "$EVENT_NAME" = "pull_request" ]; then
85+
CHANNEL="$DEV_CHANNEL"
86+
else
87+
CHANNEL="latest-rc"
88+
fi
89+
npm publish --provenance --access public --tag "$CHANNEL"
90+
# For e2e: PR uses dev channel, release uses tag name (e.g., v1.5.0)
91+
if [ "$EVENT_NAME" = "pull_request" ]; then
92+
echo "channel=$DEV_CHANNEL" >> "$GITHUB_OUTPUT"
93+
else
94+
echo "channel=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
95+
fi
96+
97+
# Comment PR (PR only)
98+
- name: Comment PR
99+
if: github.event_name == 'pull_request'
100+
uses: thollander/actions-comment-pull-request@v3
101+
env:
102+
DEV_CHANNEL: ${{ steps.version.outputs.channel }}
103+
with:
104+
message: |
105+
Published under `${{ env.DEV_CHANNEL }}` npm channel.
106+
```sh
107+
$ sf plugins install sf-git-merge-driver@${{ env.DEV_CHANNEL }}
108+
```
109+
comment-tag: dev-publish
110+
mode: recreate
111+
112+
e2e-tests:
113+
needs: [publish]
114+
uses: ./.github/workflows/run-e2e-tests.yml
115+
with:
116+
channel: ${{ needs.publish.outputs.channel }}
117+
118+
manage-version:
119+
if: github.event_name == 'workflow_dispatch'
120+
runs-on: ubuntu-latest
121+
permissions:
122+
id-token: write
123+
contents: read
124+
steps:
125+
- name: Checkout sources
126+
uses: actions/checkout@v6
127+
128+
- name: Setup node
129+
uses: actions/setup-node@v6
130+
with:
131+
node-version: 20
132+
registry-url: "https://registry.npmjs.org"
133+
134+
- run: npm install -g npm@latest
135+
136+
- name: Add dist-tag
137+
env:
138+
VERSION_NUMBER: ${{ github.event.inputs.version-number }}
139+
VERSION_ALIAS: ${{ github.event.inputs.version-alias }}
140+
run: npm dist-tag add "sf-git-merge-driver@${VERSION_NUMBER}" "$VERSION_ALIAS"
141+
142+
cleanup:
143+
if: ${{ github.event.pull_request.merged }}
144+
runs-on: ubuntu-latest
145+
permissions:
146+
id-token: write
147+
contents: read
148+
pull-requests: write
149+
steps:
150+
- uses: actions/checkout@v6
151+
152+
- uses: jwalton/gh-find-current-pr@master
153+
id: pr-number
154+
with:
155+
state: closed
156+
157+
- name: Set dev channel value
158+
id: set-dev-channel
159+
run: |
160+
DEV_CHANNEL="dev-${{ steps.pr-number.outputs.pr }}"
161+
162+
- uses: actions/setup-node@v6
163+
with:
164+
node-version: 20
165+
registry-url: "https://registry.npmjs.org"
166+
167+
- run: npm install -g npm@latest
168+
169+
- name: Remove dist-tag
170+
run: npm dist-tag rm sf-git-merge-driver "${DEV_CHANNEL}" || true
171+
172+
- name: Deprecate related dev versions
173+
run: |
174+
npm view sf-git-merge-driver versions --json | jq -r '.[]' | grep "\-dev-${DEV_CHANNEL}\." | xargs -I {} npm deprecate "sf-git-merge-driver@{}" "Deprecated dev version" || true
175+
176+
- name: Delete package dev channel PR comment
177+
uses: thollander/actions-comment-pull-request@v3
178+
with:
179+
message: |
180+
Published under `${DEV_CHANNEL}` npm channel.
181+
```sh
182+
$ sf plugins install sf-git-merge-driver@${DEV_CHANNEL}
183+
```
184+
comment-tag: dev-publish
185+
mode: delete

‎.github/workflows/on-main-push.yml‎

Lines changed: 6 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ on:
88
paths-ignore:
99
- "**.md"
1010

11+
permissions:
12+
contents: 'read'
13+
1114
jobs:
1215
build:
1316
uses: ./.github/workflows/reusable-build.yml
@@ -16,42 +19,11 @@ jobs:
1619
prepare-release:
1720
needs: [build]
1821
runs-on: ubuntu-latest
19-
outputs:
20-
release_created: ${{ steps.release.outputs.release_created }}
21-
prs_created: ${{ steps.release.outputs.prs_created }}
22-
version: ${{ steps.release.outputs.version }}
22+
permissions:
23+
contents: write
24+
pull-requests: write
2325
steps:
2426
- uses: googleapis/release-please-action@v4
25-
id: release
2627
with:
2728
token: ${{ secrets.RELEASE_PAT }}
2829
release-type: node
29-
30-
release:
31-
needs: [prepare-release]
32-
runs-on: ubuntu-latest
33-
if: ${{ needs.prepare-release.outputs.release_created == 'true' }}
34-
steps:
35-
- name: Checkout sources
36-
uses: actions/checkout@v6
37-
38-
- name: Setup node
39-
uses: actions/setup-node@v4
40-
with:
41-
node-version: 20
42-
registry-url: 'https://registry.npmjs.org'
43-
44-
- name: Setup dependencies, cache and install
45-
uses: ./.github/actions/install
46-
47-
- name: Publish to npm
48-
run: npm publish --access public --tag latest-rc
49-
env:
50-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
51-
52-
test-release:
53-
uses: ./.github/workflows/run-e2e-tests.yml
54-
needs: [prepare-release, release]
55-
with:
56-
channel: ${{ needs.prepare-release.outputs.version }}
57-
secrets: inherit

‎.github/workflows/on-merged-pull-request.yml‎

Lines changed: 0 additions & 61 deletions
This file was deleted.

0 commit comments

Comments
 (0)