fix(pkg): match repository owner casing (etherCorps) for provenance #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Release channel is driven by the branch you merge into: | |
| # main -> production (dist-tag: latest) | |
| # dev -> beta (dist-tag: beta) version must be a -beta.x prerelease | |
| # any -> next (dist-tag: next) whenever the version contains -next.x | |
| # A merge only publishes when the version in package.json is NOT already on npm, | |
| # so ordinary merges that don't bump the version are no-ops. | |
| on: | |
| push: | |
| branches: [main, dev] | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| # No secrets. Publishing uses npm Trusted Publishing (OIDC) — there is no | |
| # NPM_TOKEN in this repo to steal. id-token mints a short-lived identity npm | |
| # verifies against the trusted publisher configured on npmjs.com for this exact | |
| # repo + workflow. contents:write is only for the tag + GitHub release notes. | |
| permissions: {} | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: pnpm/action-setup@v4 | |
| # Node 24 bundles npm >= 11.5.1, which supports OIDC Trusted Publishing. | |
| # Do NOT self-upgrade npm (`npm i -g npm@latest`) — it leaves a broken | |
| # dependency tree (missing 'sigstore') and provenance publishing crashes. | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| registry-url: https://registry.npmjs.org | |
| - run: pnpm install --frozen-lockfile | |
| # Decide the dist-tag from branch + version, or skip if this channel/version | |
| # combination is not allowed. Enforces: production only from main, beta only | |
| # from dev, next from anywhere. | |
| - name: Resolve release channel | |
| id: channel | |
| working-directory: packages/sveltekit-og | |
| run: | | |
| NAME=$(node -p "require('./package.json').name") | |
| VERSION=$(node -p "require('./package.json').version") | |
| BRANCH="${GITHUB_REF_NAME}" | |
| echo "name=$NAME"; echo "version=$VERSION"; echo "branch=$BRANCH" | |
| if [[ "$VERSION" == *-next.* ]]; then | |
| TAG=next | |
| elif [[ "$BRANCH" == "dev" && "$VERSION" == *-beta.* ]]; then | |
| TAG=beta | |
| elif [[ "$BRANCH" == "main" && "$VERSION" != *-* ]]; then | |
| TAG=latest | |
| else | |
| echo "No release: version '$VERSION' is not valid for branch '$BRANCH'." >> "$GITHUB_STEP_SUMMARY" | |
| echo "publish=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| # Skip if this exact version is already on npm (merge didn't bump it). | |
| if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then | |
| echo "$NAME@$VERSION already published — skipping." >> "$GITHUB_STEP_SUMMARY" | |
| echo "publish=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| echo "publish=true" >> "$GITHUB_OUTPUT" | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| # Build runs via the package's prepublishOnly. --provenance signs a build attestation. | |
| - name: Publish to npm | |
| if: steps.channel.outputs.publish == 'true' | |
| working-directory: packages/sveltekit-og | |
| run: | | |
| echo "Publishing ${{ steps.channel.outputs.version }} with dist-tag: ${{ steps.channel.outputs.tag }}" | |
| npm publish --provenance --tag "${{ steps.channel.outputs.tag }}" | |
| # Tag the release commit and generate GitHub release notes from conventional commits. | |
| - name: Tag + GitHub release notes | |
| if: steps.channel.outputs.publish == 'true' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| TAG="v${{ steps.channel.outputs.version }}" | |
| git tag "$TAG" | |
| git push origin "$TAG" | |
| npx changelogithub |