Release #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # npm publisher for the xurl launcher. This workflow only publishes to npm via | |
| # OIDC trusted publishing (npmjs.com binds the trusted publisher to this file). | |
| # Binaries, the GitHub release, and the Homebrew cask are produced by GoReleaser | |
| # inside the "Cut Release" workflow, which dispatches this one for the npm step. | |
| # | |
| # It is workflow_dispatch only. It deliberately does NOT trigger on tag pushes: | |
| # "Cut Release" pushes the tag (with a PAT) and runs GoReleaser itself, so a | |
| # tag-push trigger here would race that GoReleaser and fail uploading duplicate | |
| # release assets. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: "Version to publish to npm (e.g. 1.2.0, no leading v)." | |
| required: true | |
| type: string | |
| permissions: | |
| contents: read | |
| jobs: | |
| publish-npm: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write # enables npm provenance and OIDC trusted publishing | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Node >= 22.14 is required for OIDC trusted publishing. | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "24" | |
| # npm >= 11.5 is required for OIDC trusted publishing. Deliberately no | |
| # registry-url / NODE_AUTH_TOKEN: a configured token (even an empty one) | |
| # makes npm take the token auth path instead of OIDC. With none set, npm | |
| # authenticates with the OIDC id-token against the trusted publisher | |
| # configured on npmjs.com -- nothing to expire or rotate. | |
| - name: Use latest npm | |
| run: npm install -g npm@latest | |
| - name: Resolve version | |
| id: ver | |
| env: | |
| VERSION: ${{ github.event.inputs.version }} | |
| run: echo "version=${VERSION#v}" >> "$GITHUB_OUTPUT" | |
| - name: Publish to npm (OIDC trusted publishing) | |
| run: | | |
| cd npm | |
| npm version "${{ steps.ver.outputs.version }}" --no-git-tag-version | |
| npm publish --provenance --access public |