44 push :
55 tags : ['v*']
66
7+ concurrency :
8+ group : release
9+ cancel-in-progress : false
10+
711jobs :
12+ verify-publish-credentials :
13+ runs-on : ubuntu-24.04
14+ timeout-minutes : 5
15+ steps :
16+ - name : Verify npm publish token
17+ run : |
18+ if [ -z "$NODE_AUTH_TOKEN" ]; then
19+ echo "NPM_TOKEN secret is required before building release binaries." >&2
20+ exit 1
21+ fi
22+ env :
23+ NODE_AUTH_TOKEN : ${{ secrets.NPM_TOKEN }}
24+
25+ build-native :
26+ needs : verify-publish-credentials
27+ strategy :
28+ fail-fast : false
29+ matrix :
30+ include :
31+ - os : macos-15
32+ target : aarch64-apple-darwin
33+ platform : darwin-arm64
34+ flags : ' '
35+ - os : macos-15-intel
36+ target : x86_64-apple-darwin
37+ platform : darwin-x64
38+ flags : ' '
39+ - os : ubuntu-24.04-arm
40+ target : aarch64-unknown-linux-gnu
41+ platform : linux-arm64-gnu
42+ flags : --use-napi-cross
43+ - os : ubuntu-24.04
44+ target : x86_64-unknown-linux-gnu
45+ platform : linux-x64-gnu
46+ flags : --use-napi-cross
47+ - os : ubuntu-24.04-arm
48+ target : aarch64-unknown-linux-musl
49+ platform : linux-arm64-musl
50+ flags : -x
51+ - os : ubuntu-24.04
52+ target : x86_64-unknown-linux-musl
53+ platform : linux-x64-musl
54+ flags : -x
55+ - os : windows-2025
56+ target : x86_64-pc-windows-msvc
57+ platform : win32-x64-msvc
58+ flags : ' '
59+ runs-on : ${{ matrix.os }}
60+ timeout-minutes : 30
61+ steps :
62+ - uses : actions/checkout@v7
63+ - uses : pnpm/action-setup@v4
64+ with :
65+ version : 11.20.0
66+ - uses : actions/setup-node@v7
67+ with :
68+ node-version : 24
69+ cache : pnpm
70+ - uses : dtolnay/rust-toolchain@stable
71+ with :
72+ toolchain : 1.97.1
73+ targets : ${{ matrix.target }}
74+ - uses : mlugg/setup-zig@v2
75+ if : contains(matrix.target, 'musl')
76+ with :
77+ version : 0.14.1
78+ - uses : taiki-e/install-action@v2
79+ if : contains(matrix.target, 'musl')
80+ with :
81+ tool : cargo-zigbuild
82+ - run : pnpm install --frozen-lockfile
83+ - name : Build native binding
84+ shell : bash
85+ run : pnpm exec napi build --release --platform --no-js --dts native.d.ts --target ${{ matrix.target }} ${{ matrix.flags }}
86+ - name : Load test native binding
87+ shell : bash
88+ run : |
89+ if [[ '${{ matrix.platform }}' == *-musl ]]; then
90+ docker run --rm -v "$PWD:/work" -w /work node:20-alpine node -e "require('./index.${{ matrix.platform }}.node')"
91+ else
92+ node -e "require('./index.${{ matrix.platform }}.node')"
93+ fi
94+ - name : Stage native package
95+ shell : bash
96+ run : |
97+ mkdir -p release/${{ matrix.platform }}
98+ cp index.${{ matrix.platform }}.node release/${{ matrix.platform }}/
99+ cp npm/${{ matrix.platform }}/package.json npm/${{ matrix.platform }}/README.md release/${{ matrix.platform }}/
100+ - uses : actions/upload-artifact@v7
101+ with :
102+ name : ${{ matrix.platform }}
103+ path : release/${{ matrix.platform }}
104+ if-no-files-found : error
105+ retention-days : 7
106+
8107 publish :
108+ needs :
109+ - verify-publish-credentials
110+ - build-native
9111 runs-on : ubuntu-24.04
112+ timeout-minutes : 20
10113 permissions :
11114 contents : read
12115 id-token : write
@@ -24,28 +127,28 @@ jobs:
24127 with :
25128 toolchain : 1.97.1
26129 - run : pnpm install --frozen-lockfile
27- - run : pnpm run build
130+ - name : Verify release source
131+ run : pnpm run check
28132 - uses : actions/download-artifact@v8
29133 with :
30134 path : artifacts
135+ - run : pnpm exec napi artifacts --output-dir artifacts --npm-dir npm
31136 - name : Verify release version and artifacts
32137 shell : bash
33138 run : |
34139 test "v$(node -p "require('./package.json').version")" = "$GITHUB_REF_NAME"
35- node scripts/check-artifacts.mjs artifacts
140+ node scripts/check-artifacts.mjs npm
141+ pnpm exec napi prepublish -t npm --no-gh-release --dry-run
36142 - name : Dry-run every package
37143 shell : bash
38144 run : |
39145 for target in darwin-arm64 darwin-x64 linux-arm64-gnu linux-arm64-musl linux-x64-gnu linux-x64-musl win32-x64-msvc; do
40- npm pack --dry-run --ignore-scripts "artifacts /$target"
146+ npm pack --dry-run --ignore-scripts "npm /$target"
41147 done
42148 npm pack --dry-run --ignore-scripts
43149 - name : Publish native packages, then root
44- shell : bash
45- run : |
46- for target in darwin-arm64 darwin-x64 linux-arm64-gnu linux-arm64-musl linux-x64-gnu linux-x64-musl win32-x64-msvc; do
47- npm publish "artifacts/$target" --access public --provenance
48- done
49- npm publish --access public --provenance
150+ run : npm publish --access public --provenance
50151 env :
51152 NODE_AUTH_TOKEN : ${{ secrets.NPM_TOKEN }}
153+ NPM_CONFIG_ACCESS : public
154+ NPM_CONFIG_PROVENANCE : true
0 commit comments