v0.3.0 #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| # Publishes create-startup-api to npm when a GitHub Release is published. | |
| # Create a release whose tag matches the package version (e.g. v0.0.1) — the | |
| # workflow verifies the two agree before publishing. Can also be run manually. | |
| # | |
| # Auth uses npm Trusted Publishing (OIDC) — no NPM_TOKEN secret. Configure the | |
| # trusted publisher once at npmjs.com → the package → Settings → Trusted | |
| # Publisher: GitHub Actions, repo StartupAPI/create-startup-api, workflow | |
| # `publish.yml`. The `id-token: write` permission below lets npm mint a | |
| # short-lived token at publish time; provenance is attached automatically. | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| id-token: write # required for npm trusted publishing (OIDC) + provenance | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Use Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '22.x' | |
| registry-url: 'https://registry.npmjs.org' | |
| # Trusted Publishing (OIDC) needs npm >= 11.5.1; the bundled npm is older. | |
| - name: Update npm | |
| run: npm install -g npm@latest | |
| - name: Smoke-check sources | |
| run: | | |
| node --check index.js | |
| node --check template/scripts/sync-assets.mjs | |
| - name: Verify tag matches package version | |
| if: github.event_name == 'release' | |
| run: | | |
| PKG_VERSION="v$(node -p "require('./package.json').version")" | |
| TAG="${GITHUB_REF_NAME}" | |
| if [ "$PKG_VERSION" != "$TAG" ]; then | |
| echo "::error::Release tag ($TAG) does not match package version ($PKG_VERSION)." | |
| exit 1 | |
| fi | |
| # No token: npm authenticates via OIDC against the configured trusted | |
| # publisher and attaches provenance automatically. | |
| - name: Publish to npm | |
| run: npm publish --access public |