feat: migrate to Trusted Publishing for npm packages #26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - release | |
| jobs: | |
| release: | |
| name: Create release | |
| runs-on: ubuntu-latest | |
| continue-on-error: false | |
| permissions: | |
| contents: write # Required to create release branches and tags | |
| pull-requests: write # Required to create release PRs | |
| outputs: | |
| releaseReady: ${{ steps.releaseOutputs.outputs.releaseReady }} | |
| steps: | |
| - name: Cancel previous jobs | |
| uses: styfle/[email protected] | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Make a release if needed | |
| uses: ./.github/actions/release | |
| id: release | |
| with: | |
| node-version: 20 | |
| release-pr-title: "chore(release): :package: version update for packages" | |
| release-commit-message: "chore(release): version update for packages" | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| release-command: "changes:release" | |
| gpg-key-base64: ${{ secrets.CI_GITHUB_GPG_KEY_BASE64 }} | |
| gpg-key-signing: ${{ secrets.CI_GITHUB_GPG_KEY_SIGNING }} | |
| - name: Generate outputs | |
| id: releaseOutputs | |
| if: steps.release.outputs.release-ready == 'true' | |
| run: echo "releaseReady=true" >> $GITHUB_OUTPUT | |
| prepare: | |
| name: Prepare packages | |
| runs-on: ubuntu-latest | |
| continue-on-error: false | |
| needs: release | |
| if: ${{ needs.release.outputs.releaseReady == 'true' }} | |
| steps: | |
| - name: Cancel previous jobs | |
| uses: styfle/[email protected] | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Prepare | |
| uses: ./.github/actions/prepare-packages | |
| with: | |
| node-version: 20 | |
| build-command: "build" | |
| publish-npm: | |
| name: Publish to NPM Registry | |
| needs: prepare | |
| runs-on: ubuntu-latest | |
| continue-on-error: false | |
| permissions: | |
| id-token: write # Required for OIDC/Trusted Publishing | |
| contents: read # Required to checkout code | |
| steps: | |
| - name: Cancel previous jobs | |
| uses: styfle/[email protected] | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Publish to NPM | |
| uses: ./.github/actions/publish | |
| with: | |
| node-version: 20 | |
| registry-url: "https://registry.npmjs.org/" | |
| artifact-name: "package-artifact" | |
| scope: "@macpaw" | |
| publish-github: | |
| name: Publish to Github Registry | |
| needs: prepare | |
| runs-on: ubuntu-latest | |
| continue-on-error: false | |
| steps: | |
| - name: Cancel previous jobs | |
| uses: styfle/[email protected] | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Publish to NPM | |
| uses: ./.github/actions/publish | |
| with: | |
| node-version: 20 | |
| registry-url: https://npm.pkg.github.com/ | |
| artifact-name: "package-artifact" | |
| scope: "@macpaw" | |
| auth-token: ${{ secrets.GITHUB_TOKEN }} |