publish.yml

name: Publish

# Registered as the npm Trusted Publisher for @aragon/gov-ui-kit. The publish
# steps run INLINE in this file (no reusable workflow) so the workflow identity
# in the OIDC token always matches the registered publisher — npm rejects the
# token exchange (404) if a reusable/called workflow runs the publish instead.
#   - release event            -> stable publish (`latest`), gated by approval
#   - manual workflow_dispatch  -> snapshot publish (snapshot-<run-id> tag)
on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  id-token: write # required for OIDC trusted publishing
  contents: read

jobs:
  release:
    if: github.event_name == 'release'
    runs-on: ubuntu-latest
    # Human approval gate: the `npm-publish` environment is configured in
    # repo Settings → Environments with @aragon/app-team as required reviewers,
    # so every stable release publish must be approved before this job runs.
    environment: npm-publish
    steps:
      - name: Checkout actions
        uses: actions/checkout@v7.0.0
        with:
          fetch-depth: 1
          sparse-checkout: |
            .github/actions/setup
      - name: Setup
        uses: ./.github/actions/setup
        with:
          # Make sure to checkout the main branch with the bumped version on the package.json file as Github does the
          # checkout of the commit SHA that triggered the publish workflow by default
          ref: main
      - name: Build library
        run: pnpm build
      - name: Publish library
        # Authenticated via OIDC trusted publishing (id-token). No auth token.
        # --provenance emits a signed build-provenance attestation.
        run: pnpm publish --access public --no-git-checks --provenance

  snapshot:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - name: Load secrets from OP
        id: load-secrets
        uses: 1password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 #v4.0.1
        with:
          export-env: false
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          ARABOT_PAT_TRIGGER_WORKFLOW: op://kv_gov-ui-kit_infra/GITHUB_PAT/credential
      - name: Checkout actions
        uses: actions/checkout@v7.0.0
        with:
          fetch-depth: 1
          sparse-checkout: |
            .github/actions/setup
      - name: Setup
        uses: ./.github/actions/setup
        with:
          # Checkout full history to correclty check changeset status
          fetch-depth: 0
          token: ${{ steps.load-secrets.outputs.ARABOT_PAT_TRIGGER_WORKFLOW }}
      - name: Check changeset
        run: pnpm changeset status --since origin/main
      - name: Build library
        run: pnpm build
      - name: Update version
        run: pnpm changeset version --snapshot
        env:
          GITHUB_TOKEN: ${{ steps.load-secrets.outputs.ARABOT_PAT_TRIGGER_WORKFLOW }}
      - name: Get package version
        id: package-version
        uses: martinbeentjes/npm-get-version-action@3cf273023a0dda27efcd3164bdfb51908dd46a5b # v1.3.1
      - name: Publish snapshot
        # Authenticated via OIDC trusted publishing (id-token). No auth token.
        # --provenance emits a signed build-provenance attestation.
        run: pnpm publish --access public --tag snapshot-${{ github.run_id }} --no-git-checks --provenance
      - name: Print snapshot version
        run: echo "Snapshot release - ${{ steps.package-version.outputs.current-version }} published with tag 'snapshot-${{ github.run_id }}'"