primer_view_components/.github/workflows/release.yml at 047ab32227bfb78f4d5a843a29a53110a573624d · opf/primer_view_components · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
name: Release
on:
  push:
  release:
    types: [published]

permissions: {}

jobs:
  publish-main:
    if: ${{ github.event_name == 'release' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # Required for OIDC
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - name: Setup Ruby
        uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1
        with:
          ruby-version: "3.4"
          bundler-cache: false
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 # zizmor: ignore[cache-poisoning]
        with:
          node-version: 24
          cache: "npm"
      - name: Create .gem credentials
        run: |
          mkdir -p $HOME/.gem
          cat << EOF > $HOME/.gem/credentials
          ---
          :rubygems_api_key: ${RUBYGEMS_TOKEN}
          EOF
          chmod 0600 $HOME/.gem/credentials
        env:
          RUBYGEMS_TOKEN: ${{ secrets.RUBYGEMS_TOKEN_SHARED }}
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 # zizmor: ignore[cache-poisoning]
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'
          cache: "npm"
      - name: NPM install
        run: |
          npm ci
      - name: Install Ruby dependencies
        run: bundle install
      - name: Publish Gem
        run: bundle exec rake release
      - name: Publish NPM
        run: npm publish --access public --provenance

  release-main:
    name: Main
    if: ${{ github.repository == 'opf/primer_view_components' && github.ref_name == 'main' && github.event_name == 'push' }}

    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 # zizmor: ignore[cache-poisoning]
        with:
          node-version: 24
          cache: "npm"

      - name: Setup Ruby
        uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1
        with:
          ruby-version: "3.4"

      - name: Install dependencies
        run: |
          npm ci
          bundle install

      # Use the primer GitHub App for authentication.
      # See: https://github.com/organizations/opf/settings/apps/openproject-primer-view-components
      - name: Get App Token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        id: get-access-token
        with:
          app-id: ${{ vars.PRIMER_APP_ID_SHARED }}
          owner: opf
          private-key: ${{ secrets.PRIMER_APP_PRIVATE_KEY_SHARED }}
          repositories: |
            primer_view_components
          permission-contents: write
          permission-pull-requests: write

      - name: Create release pull request or publish to npm
        id: changesets
        uses: changesets/action@06245a4e0a36c064a573d4150030f5ec548e4fcc # v1.4.10
        with:
          title: Release Tracking
          version: npm run changeset:version
          publish: script/changeset-publish
        env:
          GITHUB_TOKEN: ${{ steps.get-access-token.outputs.token }}

  release-canary:
    name: Canary
    if: ${{ github.repository == 'opf/primer_view_components' && github.ref_name != 'main' && github.ref_name != 'changeset-release/main' && github.event_name == 'push' }}
    permissions:
      contents: read
      statuses: write
      id-token: write # Required for OIDC
    uses: ./.github/workflows/release_canary.yml
    with:
      install: npm i
    secrets:
      gh_token: ${{ secrets.GITHUB_TOKEN }}

  release-candidate:
    name: Candidate
    if: ${{ github.repository == 'opf/primer_view_components' && github.ref_name == 'changeset-release/main' && github.event_name == 'push' }}
    permissions:
      contents: read
      statuses: write
      id-token: write # Required for OIDC
    uses: ./.github/workflows/release_candidate.yml
    secrets:
      gh_token: ${{ secrets.GITHUB_TOKEN }}