chore(release): v0.6.3 #15
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| push: | |
| tags: ["v*"] | |
| permissions: | |
| id-token: write # OIDC trusted publishing + npm provenance | |
| contents: write # create the GitHub Release | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - run: corepack enable | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| registry-url: "https://registry.npmjs.org" | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm lint | |
| - run: pnpm check | |
| - run: pnpm build | |
| - run: pnpm test | |
| - run: pnpm smoke | |
| # Idempotent: skip when this exact version is already on the registry (e.g. a manual | |
| # bootstrap publish, or a re-run of a released tag) so the tag still produces the GitHub | |
| # release below instead of failing on "cannot publish over existing version". | |
| # OIDC trusted publishing (tokenless) requires npm >= 11.5.1, but upgrading the runner's | |
| # bundled npm in place (npm i -g npm) can leave a broken tree (v0.5.1: MODULE_NOT_FOUND | |
| # sigstore mid-publish) — so run the publish through a fresh pinned npm via npx instead. | |
| - run: | | |
| NAME=$(node -p "require('./package.json').name") | |
| VERSION=$(node -p "require('./package.json').version") | |
| if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then | |
| echo "$NAME@$VERSION already published — skipping npm publish." | |
| else | |
| npx -y npm@11 publish --provenance --access public | |
| fi | |
| - run: npx changelogen@latest github release --token "$GITHUB_TOKEN" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |