Skip to content

Commit 2dba201

Browse files
authored
ci: publish signed GitHub release assets (#12)
* ci: publish signed GitHub release assets * ci: align signed-release node version and add test gate --------- Co-authored-by: Hanna Rosengren <4538260+hannasoderstromdev@users.noreply.github.com>
1 parent 369f662 commit 2dba201

1 file changed

Lines changed: 58 additions & 0 deletions

File tree

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: Signed release artifacts
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*.*.*'
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
sign_and_publish_assets:
13+
name: Sign and publish release assets
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: write
17+
id-token: write
18+
19+
steps:
20+
- name: Checkout repository
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
22+
23+
- name: Use Node.js 22.x
24+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
25+
with:
26+
node-version: 22.x
27+
cache: npm
28+
29+
- name: Install dependencies
30+
run: npm ci
31+
32+
- name: Run tests
33+
run: npm test
34+
35+
- name: Build npm package tarball
36+
run: npm pack --pack-destination dist
37+
38+
- name: Install Cosign
39+
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6
40+
41+
- name: Sign release assets with Sigstore keyless
42+
run: |
43+
set -euo pipefail
44+
for asset in dist/*.tgz; do
45+
cosign sign-blob --yes --bundle "${asset}.sigstore.json" "$asset"
46+
done
47+
48+
- name: Create or update GitHub release assets
49+
env:
50+
GITHUB_TOKEN: ${{ github.token }}
51+
run: |
52+
set -euo pipefail
53+
tag="${GITHUB_REF_NAME}"
54+
if gh release view "$tag" >/dev/null 2>&1; then
55+
gh release upload "$tag" dist/* --clobber
56+
else
57+
gh release create "$tag" dist/* --title "$tag" --generate-notes
58+
fi

0 commit comments

Comments
 (0)