2d842a31fa* Add npm publish workflow - Add .github/workflows/npm-publish.yml triggered on GitHub releases - Runs build and test jobs before publishing - Uses NPM_TOKEN secret with OIDC provenance - Smart npm tagging: latest, beta, or release-X.Y - Add prepack hook to package.json for automatic builds - Move bun from dependencies to devDependencies - Add npm test step to CI workflow 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * Add CONTRIBUTING.md with maintainer publishing guide - Getting started and development process for contributors - Pull request guidelines - Maintainer section with: - Repository setup (NPM_TOKEN, release environment) - Step-by-step release publishing instructions - npm tag documentation (latest, beta, release-X.Y) - Maintenance release workflow - Pre-release testing via pkg-pr-new 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * ... * Potential fix for code scanning alert no. 9: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
85 lines
2.2 KiB
YAML
85 lines
2.2 KiB
YAML
name: Publish to npm
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: latest
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: npm
|
|
- run: npm ci
|
|
- run: npm run build
|
|
- run: npm run prettier
|
|
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: latest
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: npm
|
|
- run: npm ci
|
|
- run: npm test
|
|
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'release'
|
|
environment: release
|
|
needs: [build, test]
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: latest
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: npm
|
|
registry-url: "https://registry.npmjs.org"
|
|
- run: npm ci
|
|
|
|
- name: Determine npm tag
|
|
id: npm-tag
|
|
run: |
|
|
VERSION=$(node -p "require('./package.json').version")
|
|
# Check if this is a beta release
|
|
if [[ "$VERSION" == *"-beta"* ]]; then
|
|
echo "tag=--tag beta" >> $GITHUB_OUTPUT
|
|
# Check if this release is from a non-main branch (patch/maintenance release)
|
|
elif [[ "${{ github.event.release.target_commitish }}" != "main" ]]; then
|
|
# Use "release-X.Y" as tag for old branch releases
|
|
MAJOR_MINOR=$(echo "$VERSION" | cut -d. -f1,2)
|
|
echo "tag=--tag release-${MAJOR_MINOR}" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "tag=" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- run: npm publish --provenance --access public ${{ steps.npm-tag.outputs.tag }}
|
|
env:
|
|
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|