Skip to content
CI

ci: publish to npm via trusted publishing instead of a stored token #1438

Sign in to view logs

ci: publish to npm via trusted publishing instead of a stored token

ci: publish to npm via trusted publishing instead of a stored token #1438

Workflow file for this run

.github/workflows/ci.yml at 9407f78
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
env:
CARGO_TERM_COLOR: always
jobs:
rustfmt:
name: Rustfmt
runs-on: blacksmith-32vcpu-ubuntu-2404
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Rust
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
with:
components: rustfmt
- name: Check Rust formatting
run: cargo fmt --all -- --check
clippy:
name: Clippy
runs-on: blacksmith-32vcpu-ubuntu-2404
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Rust
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
with:
components: clippy
- name: Mount sticky cache
uses: ./.github/actions/mount-sticky-cache
with:
key-prefix: ${{ github.repository }}-ci-${{ github.job }}
cargo: "true"
target: target
- name: Run Clippy
run: cargo clippy --workspace --all-targets -- -D warnings
typecheck:
name: TypeScript check
runs-on: blacksmith-32vcpu-ubuntu-2404
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Vite+
uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
with:
node-version-file: ".node-version"
cache: true
run-install: true
- name: Check TypeScript
run: vp run check:ts
test:
name: Test
runs-on: blacksmith-32vcpu-ubuntu-2404
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Vite+
uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
with:
node-version-file: ".node-version"
cache: true
run-install: true
- name: Setup Rust
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Mount sticky cache
uses: ./.github/actions/mount-sticky-cache
with:
key-prefix: ${{ github.repository }}-ci-${{ github.job }}
cargo: "true"
target: target
- name: Check browser availability
run: google-chrome --version
- name: Run tests
run: vp run test
vscode-test:
name: VS Code extension tests
runs-on: blacksmith-32vcpu-ubuntu-2404
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Vite+
uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
with:
node-version-file: ".node-version"
cache: true
run-install: true
- name: Setup Rust
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Mount sticky cache
uses: ./.github/actions/mount-sticky-cache
with:
key-prefix: ${{ github.repository }}-ci-${{ github.job }}
cargo: "true"
target: target
- name: Build ox-content-lsp (release)
run: vp run build:lsp
- name: Build VS Code extension
run: vp run vscode:build
- name: Run VS Code unit tests
run: vp run test:vscode-unit
- name: Run VS Code integration tests (xvfb)
# `vscode-test` launches a real Electron process, which needs an
# X server on Linux. xvfb-run -a allocates one on the fly.
run: xvfb-run -a node scripts/run-vscode-tests.mjs
zed-extension:
name: Zed extension build
runs-on: blacksmith-32vcpu-ubuntu-2404
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Rust
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
with:
targets: wasm32-unknown-unknown
- name: Build Zed extension WASM
run: cargo build --manifest-path editors/zed/Cargo.toml --target wasm32-unknown-unknown
dependency-policy:
name: Dependency policy
runs-on: blacksmith-32vcpu-ubuntu-2404
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Vite+
uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
with:
node-version-file: ".node-version"
cache: true
run-install: true
- name: Setup Rust
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Mount sticky cache
uses: ./.github/actions/mount-sticky-cache
with:
key-prefix: ${{ github.repository }}-ci-${{ github.job }}
cargo: "true"
- name: Install Cargo audit tools
run: cargo install cargo-audit cargo-deny --locked
- name: Check Cargo advisories
run: cargo audit --deny warnings
- name: Check Cargo licenses
run: cargo deny check licenses
- name: Check npm advisories
run: node scripts/check-npm-advisories.mjs
- name: Check npm licenses
run: node scripts/check-npm-licenses.mjs
package-dry-run:
name: Package dry-run
runs-on: blacksmith-32vcpu-ubuntu-2404
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Vite+
uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
with:
node-version-file: ".node-version"
cache: true
run-install: true
- name: Setup Rust
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Mount sticky cache
uses: ./.github/actions/mount-sticky-cache
with:
key-prefix: ${{ github.repository }}-ci-${{ github.job }}
cargo: "true"
target: target
- name: Build publishable packages
run: vp run build:npm
- name: Ensure generated NAPI declarations are fresh
run: git diff --exit-code -- crates/ox_content_napi/index.d.ts
- name: Pack and inspect publishable packages
run: node scripts/package-dry-run.mjs
napi-smoke:
name: NAPI smoke - ${{ matrix.os }}
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os:
- blacksmith-32vcpu-ubuntu-2404
- macos-latest
- windows-2025
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Vite+
uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
with:
node-version-file: ".node-version"
cache: true
run-install: true
- name: Setup Rust
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Mount sticky cache
if: startsWith(matrix.os, 'blacksmith-')
uses: ./.github/actions/mount-sticky-cache
with:
key-prefix: ${{ github.repository }}-ci-${{ github.job }}-${{ matrix.os }}
cargo: "true"
target: target
- name: Cache cargo
if: runner.os != 'Windows' && !startsWith(matrix.os, 'blacksmith-')
uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
# Debug build: the smoke test only verifies the binding loads and that
# parseAndRender produces correct output — it does not benchmark. A debug
# build validates the same ABI/load/correctness path far faster than the
# release profile (fat LTO + codegen-units=1). Release artifacts are built
# and verified separately in publish.yml.
- name: Build local NAPI binding
working-directory: crates/ox_content_napi
run: vp exec -- napi build
- name: Load and parse smoke test
shell: bash
run: |
node - <<'NODE'
const napi = require("./crates/ox_content_napi");
const result = napi.parseAndRender("# Hello\n\nSmoke test", { gfm: true });
if (result.errors.length > 0) {
throw new Error(result.errors.join("\n"));
}
if (!result.html.includes("Hello</h1>")) {
throw new Error(`Unexpected render output: ${result.html}`);
}
console.log(`@ox-content/napi ${napi.version()} loaded on ${process.platform}-${process.arch}`);
NODE
build:
name: Build
runs-on: blacksmith-32vcpu-ubuntu-2404
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Vite+
uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
with:
node-version-file: ".node-version"
cache: true
run-install: true
- name: Setup Rust
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
- name: Mount sticky cache
uses: ./.github/actions/mount-sticky-cache
with:
key-prefix: ${{ github.repository }}-ci-${{ github.job }}
cargo: "true"
target: target
browsers: "true"
- name: Install browsers for docs rendering
run: |
vp exec --filter @ox-content/vite-plugin -- playwright install --with-deps chromium
vp exec --filter @ox-content/vite-plugin -- puppeteer browsers install chrome-headless-shell
- name: Build
run: vp build