Version Packages (#84) #93
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| # Never run two releases against the same ref at once. | |
| concurrency: ${{ github.workflow }}-${{ github.ref }} | |
| permissions: | |
| contents: write # push the Version Packages branch, git tags, and GitHub releases | |
| pull-requests: write # open/update the Version Packages PR | |
| id-token: write # OIDC token for npm trusted publishing (no NPM_TOKEN) | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # ripgrep backs @harpua/agent-tools' file-exploration + web-research tools; | |
| # the pre-publish `build lint test` gate below runs their specs, which | |
| # shell out to `rg` (matches ci.yml). Without it the release gate fails. | |
| - name: Install ripgrep | |
| run: sudo apt-get update && sudo apt-get install -y ripgrep | |
| # Enable Corepack so the pnpm version pinned by `packageManager` is used (matches ci.yml). | |
| - name: Enable Corepack | |
| run: corepack enable | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| # Trusted publishing (OIDC) needs npm CLI >= 11.5.1; Node 22 ships npm 10.x. | |
| # `changeset publish` -> `pnpm publish` delegates the actual upload to this npm | |
| # binary, so the upgraded npm is what performs the OIDC token exchange. | |
| # PINNED (not @latest): a broken npm@latest shipped a provenance generator that | |
| # can't resolve its bundled `sigstore` module ("Cannot find module 'sigstore'"), | |
| # which aborts every publish. 11.5.1 is the OIDC minimum and bundles sigstore. | |
| - name: Upgrade npm for trusted publishing | |
| run: npm install -g npm@11.5.1 | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| # Full root protocol before any publish so a broken Version Packages merge cannot ship. | |
| - name: Build, lint, and test | |
| run: pnpm turbo build lint test --force | |
| - name: Create Release Pull Request or publish | |
| uses: changesets/action@v1 | |
| with: | |
| version: pnpm exec changeset version | |
| publish: pnpm exec changeset publish | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |