Skip to content

Add release workflow with npm trusted publisher and provenance (#76) #1

Add release workflow with npm trusted publisher and provenance (#76)

Add release workflow with npm trusted publisher and provenance (#76) #1

Workflow file for this run

name: Release
on:
push:
branches:
- main
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: false
permissions:
contents: read
env:
EMULATOR_PACKAGES: adapter-next apple aws clerk core github google microsoft mongoatlas okta resend slack stripe vercel
jobs:
check-release:
name: Check for new version
runs-on: ubuntu-latest
outputs:
should_release: ${{ steps.check.outputs.should_release }}
version: ${{ steps.check.outputs.version }}
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Compare versions to registry
id: check
run: |
LOCAL_VERSION=$(node -p "require('./packages/emulate/package.json').version")
SHOULD_RELEASE=false
REGISTRY_VERSION=$(npm view emulate version 2>/dev/null || echo "0.0.0")
echo "emulate — local: $LOCAL_VERSION, registry: $REGISTRY_VERSION"
if [ "$LOCAL_VERSION" != "$REGISTRY_VERSION" ]; then
SHOULD_RELEASE=true
fi
for pkg in $EMULATOR_PACKAGES; do
REGISTRY_VERSION=$(npm view "@emulators/$pkg" version 2>/dev/null || echo "0.0.0")
echo "@emulators/$pkg — local: $LOCAL_VERSION, registry: $REGISTRY_VERSION"
if [ "$LOCAL_VERSION" != "$REGISTRY_VERSION" ]; then
SHOULD_RELEASE=true
fi
done
echo "should_release=$SHOULD_RELEASE" >> "$GITHUB_OUTPUT"
echo "version=$LOCAL_VERSION" >> "$GITHUB_OUTPUT"
publish:
name: Publish
needs: check-release
if: needs.check-release.outputs.should_release == 'true'
runs-on: ubuntu-latest
environment: Release
permissions:
contents: read
id-token: write
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup pnpm
uses: pnpm/action-setup@v4
with:
version: 10.11.0
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "22"
cache: pnpm
registry-url: "https://registry.npmjs.org"
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Build
run: pnpm build
- name: Publish packages
run: |
LOCAL_VERSION="${{ needs.check-release.outputs.version }}"
FAILED=""
REGISTRY_VERSION=$(npm view emulate version 2>/dev/null || echo "0.0.0")
if [ "$LOCAL_VERSION" = "$REGISTRY_VERSION" ]; then
echo "emulate@$LOCAL_VERSION already published, skipping"
else
echo "Publishing emulate@$LOCAL_VERSION..."
if ! (cd packages/emulate && npm publish --provenance); then
FAILED="$FAILED emulate"
fi
fi
for pkg in $EMULATOR_PACKAGES; do
REGISTRY_VERSION=$(npm view "@emulators/$pkg" version 2>/dev/null || echo "0.0.0")
if [ "$LOCAL_VERSION" = "$REGISTRY_VERSION" ]; then
echo "@emulators/$pkg@$LOCAL_VERSION already published, skipping"
continue
fi
echo "Publishing @emulators/$pkg@$LOCAL_VERSION..."
if ! (cd "packages/@emulators/$pkg" && npm publish --provenance); then
FAILED="$FAILED @emulators/$pkg"
fi
done
if [ -n "$FAILED" ]; then
echo "Failed to publish:$FAILED"
exit 1
fi
github-release:
name: Create GitHub Release
needs: [check-release, publish]
if: needs.check-release.outputs.should_release == 'true'
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Extract changelog entry
run: |
VERSION="${{ needs.check-release.outputs.version }}"
awk '/<!-- release:start -->/{found=1; next} /<!-- release:end -->/{found=0} found{print}' CHANGELOG.md > /tmp/release-notes.md
LINES=$(wc -l < /tmp/release-notes.md | tr -d ' ')
if [ "$LINES" -lt 2 ]; then
echo "Error: No release notes found between <!-- release:start --> and <!-- release:end --> markers in CHANGELOG.md"
exit 1
fi
echo "Extracted release notes for $VERSION ($LINES lines)"
- name: Create GitHub Release
run: |
VERSION="${{ needs.check-release.outputs.version }}"
TAG="v$VERSION"
if gh release view "$TAG" &>/dev/null; then
echo "Release $TAG already exists, skipping"
else
echo "Creating release $TAG..."
gh release create "$TAG" \
--title "$TAG" \
--target ${{ github.sha }} \
--notes-file /tmp/release-notes.md
fi
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}