Skip to content

Commit f8969fa

Browse files
sarayevsarayev
committed
chore: add a new workflow for npm publish with trusted publishing
1 parent adcef05 commit f8969fa

4 files changed

Lines changed: 100 additions & 42 deletions

File tree

‎.github/workflows/callable-npm-publish-lts-release.yml‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,17 @@ on:
1010
jobs:
1111
deploy:
1212
name: Publish to Amplify Package
13+
secrets: inherit
14+
uses: ./.github/workflows/callable-npm-publish-trusted.yml
15+
with:
16+
target: ${{ inputs.target }}
17+
github_user: ${{ vars.GH_USER}}
18+
github_email: ${{ vars.GH_EMAIL}}
19+
20+
post-deploy:
21+
name: Post-deployment tasks
1322
runs-on: ubuntu-latest
23+
needs: deploy
1424
steps:
1525
- name: Checkout repository
1626
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -20,17 +30,6 @@ jobs:
2030
# Minimal depth 0 so we can fetch all git tags.
2131
fetch-depth: 0
2232

23-
- name: Setup node and build the repository
24-
uses: ./amplify-js/.github/actions/node-and-build
25-
26-
- name: Run npm publish
27-
uses: ./amplify-js/.github/actions/npm-publish
28-
with:
29-
target: ${{ inputs.target }}
30-
npm_token: ${{ secrets.NPM_TOKEN }}
31-
github_user: ${{ vars.GH_USER}}
32-
github_email: ${{ vars.GH_EMAIL}}
33-
3433
- name: Set github commit user
3534
env:
3635
GITHUB_EMAIL: ${{ vars.GH_EMAIL }}
@@ -39,6 +38,9 @@ jobs:
3938
git config --global user.email $GITHUB_EMAIL
4039
git config --global user.name $GITHUB_USER
4140
41+
- name: Setup node for docs generation
42+
uses: ./amplify-js/.github/actions/node-and-build
43+
4244
- name: Update API documentation
4345
working-directory: ./amplify-js
4446
run: |

‎.github/workflows/callable-npm-publish-preid.yml‎

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ on:
1212
type: boolean
1313

1414
jobs:
15-
deploy:
16-
name: Publish to Amplify Package
15+
validate-preid:
16+
name: Validate preid
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: Forbidden and protected preid protection
@@ -30,19 +30,13 @@ jobs:
3030
[[ $ALLOW_PROTECTED_PREIDS == 'false' ]] && for e in $PROTECTED_PREIDS; do [[ $PREID == $e ]] && echo "$PREID is protected from preid release" && exit 1; done
3131
echo "$PREID is allowed for preid release"
3232
33-
- name: Checkout repository
34-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
35-
with:
36-
path: amplify-js
37-
38-
- name: Setup node and build the repository
39-
uses: ./amplify-js/.github/actions/node-and-build
40-
41-
- name: Run npm publish
42-
uses: ./amplify-js/.github/actions/npm-publish
43-
with:
44-
target: preid
45-
preid: ${{ inputs.preid }}
46-
npm_token: ${{ secrets.NPM_TOKEN }}
47-
github_user: ${{ vars.GH_USER}}
48-
github_email: ${{ vars.GH_EMAIL}}
33+
deploy:
34+
name: Publish to Amplify Package
35+
needs: validate-preid
36+
secrets: inherit
37+
uses: ./.github/workflows/callable-npm-publish-trusted.yml
38+
with:
39+
target: preid
40+
preid: ${{ inputs.preid }}
41+
github_user: ${{ vars.GH_USER}}
42+
github_email: ${{ vars.GH_EMAIL}}

‎.github/workflows/callable-npm-publish-release.yml‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,18 @@ jobs:
1616

1717
deploy:
1818
name: Publish to Amplify Package
19-
runs-on: ubuntu-latest
2019
needs: deploy-prep
20+
secrets: inherit
21+
uses: ./.github/workflows/callable-npm-publish-trusted.yml
22+
with:
23+
target: release
24+
github_user: ${{ vars.GH_USER}}
25+
github_email: ${{ vars.GH_EMAIL}}
26+
27+
post-deploy:
28+
name: Post-deployment tasks
29+
runs-on: ubuntu-latest
30+
needs: [deploy-prep, deploy]
2131
steps:
2232
- name: Checkout repository
2333
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -27,17 +37,6 @@ jobs:
2737
# Minimal depth 0 so we can fetch all git tags.
2838
fetch-depth: 0
2939

30-
- name: Setup node and build the repository
31-
uses: ./amplify-js/.github/actions/node-and-build
32-
33-
- name: Run npm publish
34-
uses: ./amplify-js/.github/actions/npm-publish
35-
with:
36-
target: release
37-
npm_token: ${{ secrets.NPM_TOKEN }}
38-
github_user: ${{ vars.GH_USER}}
39-
github_email: ${{ vars.GH_EMAIL}}
40-
4140
- name: Set github commit user
4241
env:
4342
GITHUB_EMAIL: ${{ vars.GH_EMAIL }}
@@ -54,6 +53,9 @@ jobs:
5453
RELEASE_COMMIT_MESSAGE=$(git log -n 1 --skip 1 --pretty=oneline)
5554
if [[ $RELEASE_COMMIT_MESSAGE = *release\(required\)* ]]; then git tag -f required-release $PUBLISH_COMMIT_HASH; fi
5655
56+
- name: Setup node for docs generation
57+
uses: ./amplify-js/.github/actions/node-and-build
58+
5759
- name: Update API documentation
5860
working-directory: ./amplify-js
5961
run: |
@@ -75,4 +77,4 @@ jobs:
7577
run: |
7678
git checkout -b $TEMP_BRANCH_NAME
7779
git push origin $TEMP_BRANCH_NAME
78-
gh pr create -B main -H $TEMP_BRANCH_NAME --title 'chore: Merge release into main' --body 'Merge the recently completed release back into the main development branch. Generated by the callable-npm-publish-release workflow.'
80+
gh pr create -B main -H $TEMP_BRANCH_NAME --title 'chore: Merge release into main' --body 'Merge the recently completed release back into the main development branch. Generated by the callable-npm-publish-release workflow.'

‎.github/workflows/callable-npm-publish-trusted.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Trusted npm publisher with OIDC authentication
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
github_user:
7+
description: The git user to make commits with
8+
required: true
9+
type: string
10+
github_email:
11+
description: The git email to make commits with
12+
required: true
13+
type: string
14+
target:
15+
description: The release process target (either release or preid)
16+
required: true
17+
type: string
18+
preid:
19+
description: The preid to release to when the target is preid
20+
required: false
21+
type: string
22+
23+
jobs:
24+
publish:
25+
name: Publish to npm with trusted authentication
26+
runs-on: ubuntu-latest
27+
permissions:
28+
contents: read
29+
id-token: write # Required for npm trusted publishers
30+
steps:
31+
- name: Checkout repository
32+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
33+
with:
34+
path: amplify-js
35+
token: ${{ secrets.GH_TOKEN_AMPLIFY_JS_WRITE }}
36+
# Minimal depth 0 so we can fetch all git tags.
37+
fetch-depth: 0
38+
39+
- name: Setup node and build the repository
40+
uses: ./amplify-js/.github/actions/node-and-build
41+
42+
- name: Authenticate with npm (trusted publishers)
43+
id: npm-auth
44+
run: |
45+
if [ -n "$NPM_TOKEN" ]; then
46+
echo "Using npm trusted publishers authentication"
47+
echo "auth_token=$NPM_TOKEN" >> "$GITHUB_OUTPUT"
48+
else
49+
echo "Error: NPM_TOKEN not provided by trusted publishers"
50+
exit 1
51+
fi
52+
53+
- name: Run npm publish
54+
uses: ./amplify-js/.github/actions/npm-publish
55+
with:
56+
target: ${{ inputs.target }}
57+
preid: ${{ inputs.preid }}
58+
npm_token: ${{ steps.npm-auth.outputs.auth_token }}
59+
github_user: ${{ inputs.github_user }}
60+
github_email: ${{ inputs.github_email }}

0 commit comments

Comments
 (0)