Repository navigation
release: update packages (#37) #38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Release pipeline. | |
| # | |
| # npm is the primary channel and is published with npm trusted publishing | |
| # (OIDC), which needs the `id-token: write` permission on the publishing job. | |
| # Provenance attestations are generated by the registry during the same | |
| # exchange. | |
| # | |
| # JSR is the secondary channel. It runs as its own job after npm, so a JSR | |
| # failure is reported separately and never republishes npm: | |
| # | |
| # * the npm job skips any version that is already on the registry | |
| # (`cssforge:npm-publish`), so re-running a failed workflow is safe; | |
| # * the JSR job skips versions that are already on JSR and verifies the | |
| # published entry points (`cssforge:jsr-publish`), so re-running the failed | |
| # jobs only retries the secondary channel. | |
| # | |
| # One-time bootstrap: npm cannot configure a trusted publisher for a package | |
| # that does not exist yet, so the very first version has to be published once | |
| # from a machine with interactive npm authentication. After that, add this | |
| # workflow as a trusted publisher in the package settings on npmjs.com | |
| # (organization `Hebilicious`, repository `cssforge`, workflow `release.yaml`). | |
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| version: | |
| name: Version packages | |
| runs-on: ubuntu-latest | |
| outputs: | |
| hasChangesets: ${{ steps.changesets.outputs.hasChangesets }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup toolchain | |
| uses: moonrepo/setup-toolchain@v0 | |
| with: | |
| moon-version: "2.0.0" | |
| auto-install: true | |
| - name: Create Release Pull Request | |
| id: changesets | |
| uses: changesets/action@v1 | |
| with: | |
| # Publishing runs in the dedicated jobs below, so this command only | |
| # exists to keep the generated release PR body accurate about the | |
| # merge triggering a release. The action scans its output for | |
| # "New tag:" lines to create tags, which this command never prints. | |
| publish: echo "Publishing runs in the npm and jsr jobs of this workflow" | |
| commit: "chore(release): update release metadata" | |
| title: "release: update packages" | |
| version: moon exec --ignore-ci-checks root:version | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| npm: | |
| name: Publish to npm | |
| needs: version | |
| if: needs.version.outputs.hasChangesets == 'false' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup toolchain | |
| uses: moonrepo/setup-toolchain@v0 | |
| with: | |
| moon-version: "2.0.0" | |
| auto-install: true | |
| - name: Smoke test the packaged artifact | |
| run: moon exec --ignore-ci-checks cssforge:smoke-test | |
| - name: Publish to npm | |
| run: moon exec --ignore-ci-checks cssforge:npm-publish | |
| jsr: | |
| name: Publish to JSR | |
| needs: | |
| - version | |
| - npm | |
| if: needs.version.outputs.hasChangesets == 'false' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup toolchain | |
| uses: moonrepo/setup-toolchain@v0 | |
| with: | |
| moon-version: "2.0.0" | |
| auto-install: true | |
| - name: Setup Deno | |
| uses: denoland/setup-deno@v2 | |
| with: | |
| deno-version: v2.x | |
| - name: Publish to JSR and verify the published entry points | |
| run: moon exec --ignore-ci-checks cssforge:jsr-publish |