Repository navigation
Publish npm toolchain #67
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish npm toolchain | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: Exact release tag to publish (for example v0.13.0) | |
| required: true | |
| type: string | |
| confirm: | |
| description: Type publish to authorize irreversible registry publication | |
| required: true | |
| type: string | |
| permissions: | |
| contents: read | |
| packages: read | |
| id-token: write | |
| concurrency: | |
| group: npm-toolchain-publication | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| if: ${{ inputs.confirm == 'publish' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| environment: npm | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ inputs.tag }} | |
| fetch-depth: 0 | |
| - name: Verify exact release identity | |
| env: | |
| RELEASE_TAG: ${{ inputs.tag }} | |
| run: | | |
| test "$(git rev-list -n 1 "$RELEASE_TAG")" = "$(git rev-parse HEAD)" | |
| test "$RELEASE_TAG" = "v$(node -p "require('./package.json').version")" | |
| # No registry-url here on purpose. setup-node would write | |
| # `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}`, and npm attaches | |
| # that token to every request to that registry — so a plain `npm ci` would | |
| # send this job's GitHub token to npm, Inc. with each tarball fetch. The | |
| # registry credential is configured for the publish step alone, below. | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24.x" | |
| package-manager-cache: false | |
| - name: Install release dependencies | |
| run: npm ci | |
| env: | |
| # The repository .npmrc resolves this for `//npm.pkg.github.com/`, and | |
| # npm errors on an unresolvable environment reference, so it is set | |
| # and empty rather than removed. Nothing here installs from GitHub | |
| # Packages, so an empty value is all the install needs. | |
| NODE_AUTH_TOKEN: "" | |
| - name: Create and verify strict candidate | |
| run: | | |
| npm run build:packages | |
| node scripts/release-toolchain.mjs candidate --output-dir release/toolchain | |
| npm run release:verify -- release/toolchain | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24.x" | |
| registry-url: https://registry.npmjs.org | |
| package-manager-cache: false | |
| - name: Publish complete toolchain with provenance | |
| run: npm run release:publish -- --directory release/toolchain --staging-tag next --promote-tag latest | |
| env: | |
| # Used only to bootstrap the first registry release. Once every | |
| # package has its npm trusted publisher configured, this secret is | |
| # removed and npm authenticates this exact workflow through OIDC. | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_SCOPE_TOKEN }} | |
| NPM_UNSCOPED_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| # A pre-publish 404 must not stay cached while the helper waits for | |
| # that newly-created package to become visible. | |
| NPM_CONFIG_PREFER_ONLINE: "true" |