feat: add GitHub App token support for pushing to protected branches #14
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: TypeScript Service Release | ||
|
Check failure on line 1 in .github/workflows/typescript-service-release.yaml
|
||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| service-name: | ||
| type: string | ||
| required: true | ||
| description: "The name of the service to release" | ||
| bun-version: | ||
| type: string | ||
| required: false | ||
| default: "latest" | ||
| description: "Bun version to use" | ||
| npm-tag: | ||
| type: string | ||
| required: false | ||
| default: "latest" | ||
| description: "NPM tag to publish with" | ||
| no-npm-publish: | ||
| type: boolean | ||
| required: false | ||
| default: false | ||
| description: "Do not publish to npm" | ||
| working-directory: | ||
| type: string | ||
| required: false | ||
| default: "." | ||
| description: "Directory containing package.json" | ||
| build-command: | ||
| type: string | ||
| required: false | ||
| default: "bun run build" | ||
| description: "Build command" | ||
| labels-to-check: | ||
| type: string | ||
| required: false | ||
| default: '["release", "prerelease"]' | ||
| description: "JSON array of PR labels to check" | ||
| prerelease: | ||
| type: boolean | ||
| required: false | ||
| default: false | ||
| description: "Force prerelease (overrides label)" | ||
| release: | ||
| type: boolean | ||
| required: false | ||
| default: false | ||
| description: "Force release - does both GitHub release and npm publish" | ||
| dry-run: | ||
| type: boolean | ||
| required: false | ||
| default: false | ||
| description: "Run in dry-run mode (no actual publishing)" | ||
| secrets: | ||
| OPENAI_API_KEY: | ||
| required: true | ||
| description: "OpenAI API key for version and notes" | ||
| NPM_TOKEN: | ||
| required: false | ||
| description: "NPM token (required for npm publish)" | ||
| APP_ID: | ||
| required: false | ||
| description: "GithHub App ID only needed if you have protected branches that need to be pushed to" | ||
| APP_PRIVATE_KEY: | ||
| required: false | ||
| description: "GitHub App private key for pushing to protected branches" | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: false | ||
| jobs: | ||
| check-labels: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| pull-requests: read | ||
| contents: read | ||
| outputs: | ||
| labels: ${{ steps.check.outputs.labels }} | ||
| steps: | ||
| - name: Check PR Labels | ||
| id: check | ||
| uses: photon-hq/buildspace/.github/blocks/check-pr-label@main | ||
| with: | ||
| labels: ${{ inputs.labels-to-check }} | ||
| release-info: | ||
| needs: check-labels | ||
| if: fromJSON(needs.check-labels.outputs.labels).release || inputs.release | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| outputs: | ||
| version: ${{ steps.generate.outputs.version }} | ||
| release_notes: ${{ steps.generate.outputs.release_notes }} | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Generate Release Info | ||
| id: generate | ||
| uses: photon-hq/buildspace/.github/blocks/generate-release-info@main | ||
| with: | ||
| service-name: ${{ inputs.service-name }} | ||
| prerelease: ${{ inputs.prerelease || fromJSON(needs.check-labels.outputs.labels).prerelease }} | ||
| openai-api-key: ${{ secrets.OPENAI_API_KEY }} | ||
| bump-version: | ||
| needs: [check-labels, release-info] | ||
| if: fromJSON(needs.check-labels.outputs.labels).release || inputs.release | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| steps: | ||
| - name: Generate App Token | ||
| id: app-token | ||
| if: ${{ secrets.APP_ID != '' && secrets.APP_PRIVATE_KEY != '' }} | ||
| uses: actions/create-github-app-token@v1 | ||
| with: | ||
| app-id: ${{ secrets.APP_ID }} | ||
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | ||
| - uses: actions/checkout@v5 | ||
| with: | ||
| token: ${{ steps.app-token.outputs.token || github.token }} | ||
| ref: ${{ github.ref }} | ||
| - name: Pull latest changes | ||
| run: git pull --ff-only origin ${{ github.ref_name }} | ||
| - name: Update package.json version | ||
| working-directory: ${{ inputs.working-directory }} | ||
| run: | | ||
| VERSION="${{ needs.release-info.outputs.version }}" | ||
| echo "Updating package.json to version ${VERSION}..." | ||
| npm version ${VERSION} --no-git-tag-version --allow-same-version | ||
| echo "Updated to version ${VERSION}" | ||
| - name: Commit and push | ||
| run: | | ||
| VERSION="${{ needs.release-info.outputs.version }}" | ||
| git config user.name "github-actions[bot]" | ||
| git config user.email "github-actions[bot]@users.noreply.github.com" | ||
| git add -A | ||
| if ! git diff --staged --quiet; then | ||
| git commit -m "chore: bump version to ${VERSION}" | ||
| git pull --rebase origin ${{ github.ref_name }} | ||
| git push | ||
| fi | ||
| github-release: | ||
| needs: [check-labels, release-info, bump-version] | ||
| if: fromJSON(needs.check-labels.outputs.labels).release || inputs.release | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| steps: | ||
| - name: Create GitHub Release | ||
| uses: photon-hq/buildspace/.github/blocks/create-github-release@main | ||
| with: | ||
| version: ${{ needs.release-info.outputs.version }} | ||
| title: "${{ inputs.service-name }} v${{ needs.release-info.outputs.version }}" | ||
| notes: ${{ needs.release-info.outputs.release_notes }} | ||
| prerelease: ${{ inputs.prerelease || fromJSON(needs.check-labels.outputs.labels).prerelease }} | ||
| npm-publish: | ||
| needs: [check-labels, release-info, bump-version] | ||
| if: (fromJSON(needs.check-labels.outputs.labels).release || inputs.release) && inputs.no-npm-publish != true | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| with: | ||
| ref: ${{ github.ref_name }} | ||
| fetch-depth: 0 | ||
| - name: Publish to NPM | ||
| uses: photon-hq/buildspace/.github/blocks/publish-npm@main | ||
| with: | ||
| bun-version: ${{ inputs.bun-version }} | ||
| tag: ${{ (inputs.prerelease || fromJSON(needs.check-labels.outputs.labels).prerelease) && 'beta' || inputs.npm-tag }} | ||
| working-directory: ${{ inputs.working-directory }} | ||
| build-command: ${{ inputs.build-command }} | ||
| dry-run: ${{ inputs.dry-run }} | ||
| npm-token: ${{ secrets.NPM_TOKEN }} | ||
