Publish #877
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| on: | |
| workflow_run: | |
| workflows: ["Publish Assets"] | |
| types: [completed] | |
| permissions: | |
| id-token: write # Required for OIDC | |
| contents: write # Required for checking out code and editing release state | |
| jobs: | |
| publish: | |
| name: Publish to NPM | |
| runs-on: ubuntu-latest | |
| if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request' && startsWith(github.event.workflow_run.head_branch, 'release/v') | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | |
| with: | |
| ref: main | |
| - name: Setup mise | |
| uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3 | |
| with: | |
| experimental: true | |
| - name: Setup Takumi Guard npm registry | |
| uses: flatt-security/setup-takumi-guard-npm@9a5d797c2085b6326d3a2985c08e3a114b9b88c1 # v1 | |
| - name: Install dependencies | |
| run: pnpm install --ignore-scripts | |
| - name: Publish to npm | |
| # Keep the environment override and CLI flag together so publishing | |
| # cannot fall back to the installation proxy if either is refactored. | |
| env: | |
| PNPM_CONFIG_REGISTRY: https://registry.npmjs.org/ | |
| run: pnpm publish --registry="$PNPM_CONFIG_REGISTRY" | |
| - name: Publish target draft release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} | |
| run: | | |
| TAG="${HEAD_BRANCH#release/}" | |
| if ! echo "$TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then | |
| echo "::error::Invalid release tag derived from branch: $HEAD_BRANCH" | |
| exit 1 | |
| fi | |
| gh release edit "$TAG" --draft=false --latest | |
| # The Homebrew tap formula (Formula/rulesync.rb) is no longer updated by a | |
| # dedicated CI job here. The `goal-release` skill regenerates it from the | |
| # release's SHA256SUMS after the release PR merges and the Publish Assets | |
| # workflow uploads the binaries (scripts/generate-homebrew-formula.ts). |