EventLab/.github/workflows/release.yml at main · MasterplaYCoding/EventLab · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: read
  # Does two jobs. npm's provenance attestation is built from this workflow's
  # OIDC claims, and since 0.2.0 those same claims are how the publish
  # authenticates at all - npm trusts this repository, this workflow file and
  # this environment, rather than a token someone has to store and rotate.
  id-token: write

jobs:
  publish:
    name: publish to npm
    runs-on: ubuntu-latest
    # Named in npm's trusted publisher configuration, so this is part of what
    # authorises the publish rather than only gating it on an approval. A
    # release from any other environment is refused by the registry.
    environment: npm-publish
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
          cache: npm

      - run: npm ci

      # The tag is the only thing a human types during a release. An npm
      # publish cannot be undone, so a mismatch has to fail here.
      - name: Check the tag matches the package version
        run: node scripts/check-release-version.mjs "${{ github.ref_name }}"

      - name: Typecheck
        run: npm run typecheck

      - name: Test
        run: npm test

      - name: Public API matches the committed report
        run: npm run api:check

      # The same check CI runs, reused as the release gate: it packs the
      # tarball, installs it into a clean directory and runs the README
      # example against it. Publishing something that fails this would be
      # publishing something that does not work.
      - name: Verify packaged install and README example
        run: npm run verify:packaged

      # Order matters: the CLI depends on the core package at an exact
      # version, so the core has to exist on the registry first.
      - name: Publish the library
        run: npm publish --provenance --access public --workspace @masterplaycoding/eventlab

      - name: Publish the CLI
        run: npm publish --provenance --access public --workspace @masterplaycoding/eventlab-cli