0.1.1: answer the review — and stop shipping bytes we don't run #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Cut an Obsidian plugin release. | |
| # | |
| # git tag 0.1.0 && git push origin 0.1.0 | |
| # | |
| # Obsidian's community installer downloads exactly three files from the release | |
| # assets — main.js, manifest.json, styles.css — and matches the release tag | |
| # against the version in manifest.json. No "v" prefix: `v0.1.0` will not be | |
| # found. That mistake is silent (the plugin just never updates), so the tag is | |
| # checked against the manifest here rather than after someone reports it. | |
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "*" | |
| permissions: | |
| contents: write | |
| # Artifact attestations: `id-token` signs the provenance statement with the | |
| # run's OIDC identity, `attestations` writes it to the repository's store. | |
| # Without them a user has to take on faith that the main.js they downloaded | |
| # was built from this source — which, for a plugin that reads their documents, | |
| # is worth more than the two lines it costs. | |
| id-token: write | |
| attestations: write | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| # The plugin is a subdirectory for now; this collapses when it moves to | |
| # a repo of its own (manifest.json must sit at the repo root for the | |
| # community directory to read it). | |
| working-directory: plugin | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| - name: Check the manifest, and that the tag matches it | |
| run: node check-manifest.mjs "${GITHUB_REF#refs/tags/}" | |
| - run: npm ci | |
| - run: npm run lint | |
| - run: npm run typecheck | |
| - run: npm run build | |
| # Must run in the job that produced the files, against the exact bytes | |
| # that get attached below — an attestation over a rebuilt artifact proves | |
| # nothing about the one users download. | |
| - name: Attest the release assets | |
| uses: actions/attest-build-provenance@v4 | |
| with: | |
| subject-path: | | |
| plugin/dist/main.js | |
| plugin/dist/manifest.json | |
| plugin/dist/styles.css | |
| # Left as a draft on purpose, so the assets can be checked before anyone | |
| # can install them. When you publish it, leave "Set as a pre-release" | |
| # UNTICKED: GitHub excludes pre-releases from /releases/latest, and | |
| # Obsidian reports that as "No release matches your manifest version" — | |
| # the release is there, it just isn't the latest one. `--latest` asks for | |
| # that flag up front so publishing the draft keeps it. | |
| - name: Publish release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release create "${GITHUB_REF#refs/tags/}" \ | |
| --title "${GITHUB_REF#refs/tags/}" \ | |
| --draft --latest \ | |
| dist/main.js dist/manifest.json dist/styles.css |