-
Notifications
You must be signed in to change notification settings - Fork 115
56 lines (49 loc) · 1.96 KB
/
Copy pathrelease.yml
File metadata and controls
56 lines (49 loc) · 1.96 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
name: Release
# npm publisher for the xurl launcher. This workflow only publishes to npm via
# OIDC trusted publishing (npmjs.com binds the trusted publisher to this file).
# Binaries, the GitHub release, and the Homebrew cask are produced by GoReleaser
# inside the "Cut Release" workflow, which dispatches this one for the npm step.
#
# It is workflow_dispatch only. It deliberately does NOT trigger on tag pushes:
# "Cut Release" pushes the tag (with a PAT) and runs GoReleaser itself, so a
# tag-push trigger here would race that GoReleaser and fail uploading duplicate
# release assets.
on:
workflow_dispatch:
inputs:
version:
description: "Version to publish to npm (e.g. 1.2.0, no leading v)."
required: true
type: string
permissions:
contents: read
jobs:
publish-npm:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write # enables npm provenance and OIDC trusted publishing
steps:
- uses: actions/checkout@v4
# Node >= 22.14 is required for OIDC trusted publishing.
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: "24"
# npm >= 11.5 is required for OIDC trusted publishing. Deliberately no
# registry-url / NODE_AUTH_TOKEN: a configured token (even an empty one)
# makes npm take the token auth path instead of OIDC. With none set, npm
# authenticates with the OIDC id-token against the trusted publisher
# configured on npmjs.com -- nothing to expire or rotate.
- name: Use latest npm
run: npm install -g npm@latest
- name: Resolve version
id: ver
env:
VERSION: ${{ github.event.inputs.version }}
run: echo "version=${VERSION#v}" >> "$GITHUB_OUTPUT"
- name: Publish to npm (OIDC trusted publishing)
run: |
cd npm
npm version "${{ steps.ver.outputs.version }}" --no-git-tag-version
npm publish --provenance --access public