v1.2.3 #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Publish to npm when a GitHub release is promoted from prerelease to full release. | |
| # Downloads the npm package tarball from the release (no rebuild). | |
| # | |
| # AUTH: npm OIDC trusted publishing (no long-lived NPM_TOKEN). One-time setup on | |
| # npmjs.com for `@spacedevin/deck`: Settings > Trusted Publisher > GitHub Actions: | |
| # Organization or user: spacedevin | |
| # Repository: deck | |
| # Workflow filename: npm-release.yml | |
| # Environment: (leave blank) | |
| # Requires npm >= 11.5.1 (upgraded below) and the id-token: write permission. | |
| name: NPM release | |
| on: | |
| release: | |
| types: [published, edited] | |
| jobs: | |
| publish: | |
| name: Publish to npm | |
| if: github.event.release.prerelease == false | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # required to update release body via API | |
| id-token: write # required for npm OIDC trusted publishing | |
| env: | |
| # No NODE_AUTH_TOKEN — auth is via OIDC. | |
| # Provenance disabled: packages publish from pre-built tarballs (built in CI, not this run). | |
| NPM_CONFIG_PROVENANCE: "false" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: refs/tags/${{ github.event.release.tag_name }} | |
| fetch-depth: 0 | |
| - name: Download npm package tarball from release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| # Look the asset up through the API, NOT `github.event.release.assets`. That payload is a | |
| # snapshot frozen when the release event fired, and ci.yml creates the release BEFORE it | |
| # finishes uploading the tarball — so this races, and a re-run replays the SAME frozen | |
| # payload and fails identically forever. (tishlang/tish#593 — it cost v3.2.1 its npm publish.) | |
| for attempt in 1 2 3 4 5 6 7 8 9 10; do | |
| DECK_URL=$(curl -sL -H "Authorization: Bearer $GITHUB_TOKEN" \ | |
| -H "Accept: application/vnd.github+json" \ | |
| "https://api.github.com/repos/${{ github.repository }}/releases/${{ github.event.release.id }}/assets?per_page=100" \ | |
| | jq -r '.[] | select(.name == "spacedevin-deck-npm-package.tgz" and .state == "uploaded") | .url') | |
| [ -n "$DECK_URL" ] && [ "$DECK_URL" != "null" ] && break | |
| echo "tarball not uploaded yet (attempt $attempt/10) — waiting 30s" | |
| sleep 30 | |
| done | |
| if [ -z "$DECK_URL" ] || [ "$DECK_URL" = "null" ]; then | |
| echo "Release has no uploaded asset spacedevin-deck-npm-package.tgz after 5 minutes" | |
| exit 1 | |
| fi | |
| curl -sL -H "Authorization: Bearer $GITHUB_TOKEN" -H "Accept: application/octet-stream" "$DECK_URL" -o spacedevin-deck-npm-package.tgz | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "24" | |
| registry-url: "https://registry.npmjs.org" | |
| - name: Upgrade npm for OIDC trusted publishing (needs >= 11.5.1) | |
| run: | | |
| # Pinned to npm 11.x (not 12.x) — same rationale as tishlang/lattish npm-release.yml. | |
| npm install -g "npm@^11" | |
| npm --version | |
| - name: Publish @spacedevin/deck to npm | |
| run: npm publish spacedevin-deck-npm-package.tgz --access public | |
| - name: Update release description with npm URL | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| TAG="${{ github.event.release.tag_name }}" | |
| VERSION="${TAG#v}" | |
| NPM_URL="https://www.npmjs.com/package/@spacedevin/deck/v/${VERSION}" | |
| RELEASE_ID="${{ github.event.release.id }}" | |
| REPO="${{ github.repository }}" | |
| CURRENT_BODY=$(curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \ | |
| "https://api.github.com/repos/${REPO}/releases/${RELEASE_ID}" | jq -r '.body // ""') | |
| NEW_BODY="${CURRENT_BODY} | |
| --- | |
| Published to npm: ${NPM_URL}" | |
| curl -s -X PATCH \ | |
| -H "Authorization: Bearer $GITHUB_TOKEN" \ | |
| -H "Accept: application/vnd.github+json" \ | |
| -H "X-GitHub-Api-Version: 2022-11-28" \ | |
| "https://api.github.com/repos/${REPO}/releases/${RELEASE_ID}" \ | |
| -d "$(printf '%s' "$NEW_BODY" | jq -Rs '{body: .}')" |