AutoFlow Publish Existing #114
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: AutoFlow Publish Existing | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Target version (e.g., 0.41.0-alpha.1)' | |
| required: true | |
| pr_ci_run_id: | |
| description: 'Run id of the AutoFlow CI pull_request run whose exact-SHA evidence artifact authorizes this release' | |
| required: true | |
| dry_run: | |
| description: 'Validate the release plan without publishing, pushing, tagging, or writing evidence' | |
| required: false | |
| default: false | |
| type: boolean | |
| concurrency: | |
| group: openelement-release | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| name: Execute release | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 120 | |
| permissions: | |
| contents: write | |
| # npm Trusted Publishing/OIDC (#1187): id-token is the ONLY npm | |
| # credential. Requires per-package trusted-publisher registration on | |
| # npmjs.com first — see docs/runbooks/npm-trusted-publishing.md. | |
| id-token: write | |
| # #997 / ADR-0134: the release-tier fullstack:evidence-freshness gate | |
| # reads the run history (scheduled and workflow_dispatch) of the | |
| # tier-2/tier-3 smoke workflows through the Actions API; GITHUB_TOKEN | |
| # needs actions:read for that. | |
| actions: read | |
| steps: | |
| # v7.0.1 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # zizmor: ignore[artipacked] the release lane pushes the immutable release tag with this credential (tools/autoflow/release.ts); every other workflow sets persist-credentials: false | |
| with: | |
| ref: main | |
| fetch-depth: 0 | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: ./.github/actions/setup-deno-workspace | |
| # v7.0.0 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 | |
| with: | |
| node-version: '22' | |
| # Registry config only (provenance + publish target); auth comes | |
| # exclusively from npm Trusted Publishing/OIDC (#1187). | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Upgrade npm CLI for Trusted Publishing | |
| # #1187 (Beta.2 slice, B2.12): publication authenticates via npm | |
| # Trusted Publishing. The npm CLI performs the GitHub Actions OIDC | |
| # exchange natively only from 11.5.1; Node 22's bundled npm is older, | |
| # and switching the whole release lane to Node 24 would still leave | |
| # the floor to whatever npm that image bundles, so the floor is | |
| # pinned explicitly here and verified before publish runs. | |
| run: | # zizmor: ignore[adhoc-packages] the npm floor is pinned and asserted immediately below; trusted publishing requires it | |
| npm install -g "npm@^11.5.1" | |
| actual="$(npm --version)" | |
| minimum="11.5.1" | |
| if [ "$(printf '%s\n%s\n' "$minimum" "$actual" | sort -V | head -n1)" != "$minimum" ]; then | |
| echo "npm CLI $actual is below the Trusted Publishing floor $minimum" | |
| exit 1 | |
| fi | |
| echo "npm CLI $actual satisfies the Trusted Publishing floor ($minimum)" | |
| - name: Install Playwright browsers | |
| # All three engines: the release tier includes fixture:request-time:gate, | |
| # which runs the request-time fixture suite on Chromium, Firefox and | |
| # WebKit (release evidence requirement). | |
| run: ./node_modules/.bin/playwright install --with-deps chromium firefox webkit | |
| - name: Configure Git | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| - name: Download the exact named PR CI evidence artifact | |
| # #1156 (ADR-0146): publication fails closed unless the exact-SHA PR | |
| # full-CI record, produced by the named source run for the exact HEAD | |
| # this job checked out, is present. The artifact name is derived from | |
| # HEAD, never from free-form input, and the release CLI independently | |
| # resolves the run through the GitHub API before publishing. | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_CI_RUN_ID: ${{ inputs.pr_ci_run_id }} | |
| run: | | |
| set -eu | |
| PR_CI_ARTIFACT="pr-full-ci-evidence-$(git rev-parse HEAD)" | |
| echo "evidence artifact: ${PR_CI_ARTIFACT} from run ${PR_CI_RUN_ID}" | |
| rm -rf .artifacts/pr-ci | |
| gh run download "$PR_CI_RUN_ID" --name "$PR_CI_ARTIFACT" --dir .artifacts/pr-ci | |
| test -f .artifacts/pr-ci/pr-full-ci-evidence.json | |
| count="$(find .artifacts/pr-ci -type f | wc -l | tr -d ' ')" | |
| if [ "$count" -ne 1 ]; then | |
| echo "ambiguous evidence artifact contents: expected exactly one file, got $count" | |
| exit 1 | |
| fi | |
| - name: Publish version already merged to main | |
| # PRECONDITION (#1187, maintainer web action, cannot be done in-repo): | |
| # each of the five @openelement packages (element, app, adapter-vite, | |
| # create, ui) must have this repo's GitHub Actions trusted publisher | |
| # registered on npmjs.com — repo open-element/openelement, workflow | |
| # filename autoflow-release.yml, no environment. See | |
| # docs/runbooks/npm-trusted-publishing.md. Until that registration | |
| # exists, this step fails at npm with an auth error; there is NO | |
| # token fallback by design (the long-lived npm token path is removed). | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| RELEASE_VERSION: ${{ inputs.version }} | |
| RELEASE_DRY_RUN: ${{ inputs.dry_run && '--dry-run' || '' }} | |
| PR_CI_EVIDENCE: .artifacts/pr-ci/pr-full-ci-evidence.json | |
| run: | | |
| # shellcheck disable=SC2086 # RELEASE_DRY_RUN is intentionally | |
| # word-split: it is either empty or the single flag --dry-run. | |
| deno task autoflow:publish-existing --to "$RELEASE_VERSION" --pr-ci "$PR_CI_EVIDENCE" $RELEASE_DRY_RUN |