This repository was archived by the owner on Jul 28, 2026. It is now read-only.
v2.5.1: Pin ws to 8.x, remove webpack analyser and improve wsOptions type #72
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to NPM | |
| on: | |
| release: | |
| types: | |
| - published | |
| permissions: | |
| contents: read | |
| id-token: write | |
| jobs: | |
| publish-npm: | |
| environment: production | |
| runs-on: ubuntu-latest | |
| env: | |
| RELEASE_TAG: ${{ github.event.release.tag_name }} | |
| IS_PRERELEASE: ${{ github.event.release.prerelease }} | |
| steps: | |
| - name: Checkout (no repo token persisted) | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| ref: ${{ github.event.release.tag_name }} | |
| - name: Setup Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: '.nvmrc' | |
| registry-url: https://registry.npmjs.org/ | |
| package-manager-cache: false | |
| - name: Assert latest npm | |
| # run: npm i -g npm@latest # pin to v11 until npm v12 bug is fixed: https://github.com/npm/cli/issues/9722 | |
| run: npm i -g npm@11 | |
| - name: Guard - block registry overrides and shady files | |
| run: | | |
| # fail if any .npmrc exists in repo | |
| if git ls-files -z | xargs -0 -I{} bash -lc '[[ "{}" == *.npmrc ]]' | grep -q .; then | |
| echo "Repo contains an .npmrc. Refusing to publish."; exit 1; | |
| fi | |
| # fail if publishConfig.registry set | |
| node -e "const p=require('./package.json'); if(p.publishConfig?.registry){console.error('publishConfig.registry present — refuse to publish'); process.exit(1)}" | |
| # optional: block workflow/script changes in the release commit | |
| SHA=$(git rev-list -n 1 "$RELEASE_TAG") | |
| PARENT=$(git rev-list -n 1 "$SHA^") | |
| git diff --name-only "$PARENT" "$SHA" | grep -E '^\\.github/(workflows|scripts)/' \ | |
| && { echo 'Workflow/scripts changed in release commit — refuse.'; exit 1; } || true | |
| - name: Verify tag matches package version | |
| run: | | |
| PKG_VERSION=$(node -p "require('./package.json').version") | |
| TAG="${RELEASE_TAG#v}" | |
| [[ "$PKG_VERSION" == "$TAG" ]] || { echo "Tag v$TAG != package.json $PKG_VERSION"; exit 1; } | |
| - name: Install deps (no lifecycle scripts) | |
| run: npm ci --ignore-scripts | |
| - run: npm run clean | |
| - run: npm run build | |
| - name: Resolve dist-tag | |
| id: dist | |
| run: | | |
| if [ "$IS_PRERELEASE" = "true" ]; then | |
| echo "tag=beta" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "tag=latest" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Publish | |
| env: | |
| NPM_CONFIG_PROVENANCE: true | |
| DIST_TAG: ${{ steps.dist.outputs.tag }} | |
| run: npm publish --access public --ignore-scripts --registry=https://registry.npmjs.org/ --provenance --tag "$DIST_TAG" |