publish #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Publish the release to npm. | |
| # | |
| # moshcode's own install path is `curl … install.sh | sh`, and npm is a second | |
| # channel rather than the primary one — which is exactly why it needs to be | |
| # automatic. A channel that only updates when someone remembers is a channel | |
| # that silently serves an old version forever. | |
| # | |
| # Runs on a published GitHub release, so the release itself is the trigger and | |
| # there is no separate step to forget. `workflow_dispatch` is for re-running one | |
| # that failed on something transient; it is safe because a version already on | |
| # the registry is skipped rather than attempted. | |
| # | |
| # Authenticates with a stored npm automation token, in the repository secret | |
| # `NPM_TOKEN`. Trusted publishing (OIDC) would avoid the stored credential and | |
| # was tried twice; both attempts failed with npm reporting no credential at all, | |
| # and the registration on npmjs.com — the web-UI half of it, pinned to this | |
| # file's name — is what remains unconfirmed. See #305, #309, #311. | |
| # | |
| # If you go back to OIDC, the trap is below: `registry-url` is *required* here | |
| # and *fatal* there. setup-node writes | |
| # | |
| # //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN} | |
| # | |
| # which is how the token reaches npm — and under OIDC, with no token to fill it, | |
| # resolves to an empty credential that stops npm attempting the exchange. | |
| # Removing it changed the error from E404 to ENEEDAUTH but did not publish. | |
| # actions/setup-node#1551, npm/cli#9088. | |
| # | |
| # Since then setup-node v7 stopped exporting a dummy NODE_AUTH_TOKEN when no | |
| # token is set (actions/setup-node#1558), which is the half of that trap that | |
| # corrupted .npmrc under OIDC. It does not affect the token path — we set | |
| # NODE_AUTH_TOKEN explicitly — but it means trusted publishing is worth a third | |
| # attempt before the 2FA-bypass deprecation below forces one. | |
| # | |
| # Worth knowing when this is next revisited: npm is restricting tokens that | |
| # bypass 2FA for direct publishing, so the token path has a horizon. | |
| # https://gh.io/npm-gat-bypass2fa-deprecation | |
| name: publish | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| # Still needed with token auth: provenance is signed with a short-lived OIDC | |
| # token even though the publish itself authenticates with NPM_TOKEN. Without | |
| # it `--provenance` fails. | |
| id-token: write | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # pnpm version is read from the "packageManager" field in package.json. | |
| # Do not pin a version here — it conflicts with packageManager and fails | |
| # with ERR_PNPM_BAD_PM_VERSION. | |
| - uses: pnpm/action-setup@v6 | |
| # `registry-url` is what makes setup-node write the .npmrc line that feeds | |
| # NODE_AUTH_TOKEN to npm. Required for token auth — and the thing to delete | |
| # first if this ever moves back to OIDC. | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| registry-url: https://registry.npmjs.org | |
| - run: pnpm install --frozen-lockfile | |
| # Publishing is the one action here that cannot be taken back — npm will | |
| # not let a version be replaced — so the tests run first, on the exact | |
| # tree about to be packed. | |
| - run: pnpm run --if-present test | |
| env: | |
| CI: true | |
| - name: Read the version being published | |
| id: version | |
| run: | | |
| VERSION="$(node -p "require('./package.json').version")" | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| echo "moshcode@$VERSION" | |
| # A release tagged v0.25.0 carrying package.json 0.24.0 would publish the | |
| # wrong tree under a version nobody can reuse. Cheap to check, impossible | |
| # to undo. | |
| - name: Check the tag matches package.json | |
| if: github.event_name == 'release' | |
| env: | |
| TAG: ${{ github.event.release.tag_name }} | |
| VERSION: ${{ steps.version.outputs.version }} | |
| run: | | |
| if [ "$TAG" != "v$VERSION" ]; then | |
| echo "::error::release tag $TAG does not match package.json version $VERSION" | |
| exit 1 | |
| fi | |
| # Makes a re-run harmless. Without it, dispatching the workflow twice | |
| # fails the second time on an E403 that reads like something broke. | |
| - name: Skip if this version is already on npm | |
| id: published | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| run: | | |
| if npm view "moshcode@$VERSION" version >/dev/null 2>&1; then | |
| echo "already=true" >> "$GITHUB_OUTPUT" | |
| echo "moshcode@$VERSION is already published — nothing to do" | |
| else | |
| echo "already=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Said plainly here, rather than as the E404/no-permission npm otherwise | |
| # returns partway through a release — an error that reads as "the package | |
| # does not exist" rather than "there is no credential". | |
| - name: Require an npm token | |
| if: steps.published.outputs.already == 'false' | |
| env: | |
| NPM_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| run: | | |
| if [ -z "$NPM_TOKEN" ]; then | |
| echo "::error::NPM_TOKEN is not set — add an npm automation token as a repository secret named NPM_TOKEN" | |
| exit 1 | |
| fi | |
| - name: Publish | |
| if: steps.published.outputs.already == 'false' | |
| run: npm publish --access public --provenance | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Confirm the registry has it | |
| if: steps.published.outputs.already == 'false' | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| run: | | |
| # The registry is read-through cached, so a fresh publish can 404 for | |
| # a moment. Retry rather than report a good publish as a failure. | |
| for _ in 1 2 3 4 5; do | |
| if [ "$(npm view "moshcode@$VERSION" version 2>/dev/null)" = "$VERSION" ]; then | |
| echo "moshcode@$VERSION is on the registry" | |
| exit 0 | |
| fi | |
| sleep 5 | |
| done | |
| echo "::error::published, but the registry does not report moshcode@$VERSION yet" | |
| exit 1 |