0.1.4 #5
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: ["v*"] | |
| permissions: | |
| contents: read | |
| # OIDC token for npm trusted publishing — no stored npm token needed. | |
| id-token: write | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Version comes from the packageManager field in package.json. | |
| - uses: pnpm/action-setup@v6 | |
| # No registry-url here: it would write an _authToken line into | |
| # .npmrc, and any configured token makes the npm CLI skip the | |
| # OIDC exchange that trusted publishing requires. | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| # Publishing uses the npm CLI (trusted publishing requires | |
| # npm >= 11.5; Node 22 bundles 10.x). | |
| - run: npm install -g npm@latest | |
| - run: pnpm install --frozen-lockfile | |
| - name: Verify tag matches package version | |
| run: | | |
| TAG="${GITHUB_REF_NAME#v}" | |
| VERSION="$(node -p "require('./package.json').version")" | |
| if [ "$TAG" != "$VERSION" ]; then | |
| echo "Tag v$TAG does not match package version $VERSION" >&2 | |
| exit 1 | |
| fi | |
| # Workspace packages ride the same version, always. | |
| node ./scripts/sync-workspace-versions.mjs --check | |
| # Build + typechecks + tests + audit + packaged-tarball smoke. | |
| - run: pnpm run check:release | |
| - name: Publish to npm | |
| run: | | |
| VERSION="$(node -p "require('./package.json').version")" | |
| case "$VERSION" in | |
| *-*) DIST_TAG=next ;; | |
| *) DIST_TAG=latest ;; | |
| esac | |
| # The root is a private workspace shell; everything | |
| # publishable lives under packages/, in version lockstep. | |
| # Each needs this repo registered as its trusted publisher. | |
| for package in packages/*/; do | |
| (cd "$package" && npm publish --tag "$DIST_TAG") | |
| done |