Publish branch with JFrog #14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish branch with JFrog | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| branch: | |
| description: "Branch to publish" | |
| required: true | |
| default: "main" | |
| permissions: | |
| id-token: write | |
| packages: write | |
| contents: read | |
| attestations: write | |
| env: | |
| NPM_REGISTRY: jfrog.ledgerlabs.net/artifactory/api/npm/ledgerlive-npm-sandbox-green | |
| jobs: | |
| publish: | |
| runs-on: public-ledgerhq-shared-small | |
| defaults: | |
| run: | |
| working-directory: ./lib/ | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v2 | |
| with: | |
| version: 9.6.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| registry-url: https://registry.npmjs.org/ | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Build project | |
| run: pnpm run build | |
| - name: Set branch version | |
| run: | | |
| SANITIZED_BRANCH=$(echo "${{ github.event.inputs.branch }}" | sed 's/[\/\_]/-/g') | |
| CURRENT_VERSION=$(node -p "require('./package.json').version") | |
| NEW_VERSION="${CURRENT_VERSION}-${SANITIZED_BRANCH}" | |
| npm version "$NEW_VERSION" --no-git-tag-version | |
| echo "Publishing version: $NEW_VERSION" | |
| - name: Attest for npmjs.com | |
| id: attest | |
| uses: LedgerHQ/actions-security/actions/attest-for-npmsjs-com@xchalle/attest-action-package-manager-support | |
| with: | |
| subject-path: ./lib | |
| package-manager: npm | |
| - name: Sign tarball | |
| uses: LedgerHQ/actions-security/actions/sign-blob@actions/sign-blob-1 | |
| with: | |
| path: ${{ steps.attest.outputs.tarball-path }} | |
| - name: Login to JFrog Ledger | |
| id: jfrog-login | |
| uses: LedgerHQ/actions-security/actions/jfrog-login@actions/jfrog-login-1 | |
| - name: Setup npm config for JFrog | |
| env: | |
| NPM_REGISTRY_TOKEN: ${{ steps.jfrog-login.outputs.oidc-token }} | |
| run: | | |
| cat << EOF | tee .npmrc | |
| registry=https://${NPM_REGISTRY}/ | |
| //${NPM_REGISTRY}/:_authToken=${NPM_REGISTRY_TOKEN} | |
| EOF | |
| - name: Publish package to JFrog | |
| run: pnpm publish ${{ steps.attest.outputs.tarball-path }} --no-git-checks | |
| - name: Upload tarball as artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: npm-package | |
| path: ${{ steps.attest.outputs.tarball-path }} | |
| retention-days: 1 |