0.6.1 #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release on NPM | |
| on: | |
| push: | |
| tags: | |
| - 'v*.*.*' | |
| permissions: | |
| id-token: write # Required for OIDC | |
| contents: read | |
| concurrency: | |
| group: release-on-npm-${{ github.ref_name }} | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.ref }} | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - name: Verify tag is on the main branch | |
| run: | | |
| set -euo pipefail | |
| git fetch --no-tags origin refs/heads/main:refs/remotes/origin/main | |
| if ! git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main; then | |
| echo "::error::Tag ${GITHUB_REF_NAME} (${GITHUB_SHA}) is not an ancestor of main. Refusing to publish." | |
| exit 1 | |
| fi | |
| echo "Tag ${GITHUB_REF_NAME} verified as ancestor of main." | |
| # Pinned explicitly to avoid pulling a compromised "latest" at release time; bump via dedicated PR. | |
| - run: npm i -g corepack@0.35.0 && corepack enable | |
| # setup-node does not enable any package-manager cache here (no `cache:` input), | |
| # so cache poisoning is not a concern on this release workflow. | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # zizmor: ignore[cache-poisoning] v7.0.0 | |
| with: | |
| registry-url: 'https://registry.npmjs.org' | |
| node-version-file: '.nvmrc' | |
| # npm 11.5.1 or later is required for OIDC. Pinned explicitly to avoid | |
| # pulling a compromised "latest" at release time; bump via dedicated PR. | |
| - run: npm install -g npm@11.16.0 | |
| - name: Install root JS dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Publish on NPM | |
| run: pnpm publish --recursive --access public --no-git-checks --provenance |