5c9665325d* version: 0.0.2 * Switch to npm trusted publishing (OIDC) - Remove NPM_TOKEN secret requirement from npm-publish workflow - Uses OIDC for authentication (more secure, no long-lived tokens) - Update CONTRIBUTING.md with trusted publisher setup instructions 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * 0.0.3 --------- Co-authored-by: Claude <noreply@anthropic.com>
85 lines
2.3 KiB
YAML
85 lines
2.3 KiB
YAML
name: Publish to npm
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: latest
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: npm
|
|
- run: npm ci
|
|
- run: npm run build
|
|
- run: npm run prettier
|
|
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: latest
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: npm
|
|
- run: npm ci
|
|
- run: npm test
|
|
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'release'
|
|
environment: Release
|
|
needs: [build, test]
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: latest
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: npm
|
|
registry-url: "https://registry.npmjs.org"
|
|
- run: npm ci
|
|
|
|
- name: Determine npm tag
|
|
id: npm-tag
|
|
run: |
|
|
VERSION=$(node -p "require('./package.json').version")
|
|
# Check if this is a beta release
|
|
if [[ "$VERSION" == *"-beta"* ]]; then
|
|
echo "tag=--tag beta" >> $GITHUB_OUTPUT
|
|
# Check if this release is from a non-main branch (patch/maintenance release)
|
|
elif [[ "${{ github.event.release.target_commitish }}" != "main" ]]; then
|
|
# Use "release-X.Y" as tag for old branch releases
|
|
MAJOR_MINOR=$(echo "$VERSION" | cut -d. -f1,2)
|
|
echo "tag=--tag release-${MAJOR_MINOR}" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "tag=" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
# Uses OIDC trusted publishing - no NPM_TOKEN needed
|
|
# Configure at: https://www.npmjs.com/package/@modelcontextprotocol/ext-apps/access
|
|
- run: npm publish --provenance --access public ${{ steps.npm-tag.outputs.tag }}
|