Fix --yes confirmation gate bypass on destructive commands + token-ex… #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CLI Release | |
| # Triggered by pushing a tag like `cli-v0.1.0`. Builds standalone binaries for | |
| # linux-x64, darwin-x64+arm64, and windows-x64 using Bun's --compile, then | |
| # attaches them to a GitHub Release alongside SHA256SUMS for verification. | |
| # | |
| # Bun cross-compiles from any host, so we run the whole matrix on one Linux | |
| # runner. | |
| on: | |
| push: | |
| tags: | |
| - "cli-v*" | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Release tag (e.g. cli-v0.1.0). When run via workflow_dispatch, no GitHub Release is created — artifacts are uploaded for manual download only." | |
| required: true | |
| jobs: | |
| compile: | |
| name: Compile binaries | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write # npm provenance | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| registry-url: "https://registry.npmjs.org" | |
| scope: "@cryptohopper" | |
| - name: Install CLI deps | |
| run: npm ci | |
| - name: Typecheck | |
| run: npx tsc --noEmit | |
| - name: Verify package version matches tag | |
| if: startsWith(github.ref, 'refs/tags/cli-v') | |
| run: | | |
| TAG="${GITHUB_REF_NAME#cli-v}" | |
| PKG=$(node -p "require('./package.json').version") | |
| if [ "$TAG" != "$PKG" ]; then | |
| echo "Tag $GITHUB_REF_NAME (→ $TAG) does not match package.json $PKG" | |
| exit 1 | |
| fi | |
| - name: Build Node dist (tsup) | |
| run: npm run build | |
| - name: Publish to npm with provenance | |
| if: startsWith(github.ref, 'refs/tags/cli-v') | |
| run: npm publish --provenance --access public | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Compile (linux-x64) | |
| run: npm run compile:linux-x64 | |
| - name: Compile (darwin-x64) | |
| run: npm run compile:darwin-x64 | |
| - name: Compile (darwin-arm64) | |
| run: npm run compile:darwin-arm64 | |
| - name: Compile (windows-x64) | |
| run: npm run compile:windows-x64 | |
| - name: Generate SHA256SUMS | |
| working-directory: dist | |
| run: | | |
| sha256sum cryptohopper-linux-x64 cryptohopper-darwin-x64 cryptohopper-darwin-arm64 cryptohopper-windows-x64.exe > SHA256SUMS | |
| cat SHA256SUMS | |
| - name: List build artifacts | |
| working-directory: dist | |
| run: ls -lh cryptohopper-* SHA256SUMS | |
| - name: Upload artifacts (workflow_dispatch only) | |
| if: github.event_name == 'workflow_dispatch' | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: cryptohopper-cli-binaries | |
| path: | | |
| dist/cryptohopper-linux-x64 | |
| dist/cryptohopper-darwin-x64 | |
| dist/cryptohopper-darwin-arm64 | |
| dist/cryptohopper-windows-x64.exe | |
| dist/SHA256SUMS | |
| retention-days: 14 | |
| - name: Create GitHub Release | |
| if: startsWith(github.ref, 'refs/tags/cli-v') | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| name: ${{ github.ref_name }} | |
| prerelease: ${{ contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-rc') }} | |
| generate_release_notes: true | |
| fail_on_unmatched_files: true | |
| files: | | |
| dist/cryptohopper-linux-x64 | |
| dist/cryptohopper-darwin-x64 | |
| dist/cryptohopper-darwin-arm64 | |
| dist/cryptohopper-windows-x64.exe | |
| dist/SHA256SUMS | |
| body: | | |
| ## Install | |
| **npm (any platform with Node 20+)** | |
| ```bash | |
| npm i -g @cryptohopper/cli | |
| # or one-shot: | |
| npx @cryptohopper/cli login | |
| ``` | |
| The Bun-compiled binaries below are the recommended path for non-Node users (faster cold start, no Node dependency). | |
| **macOS (Apple Silicon)** | |
| ```bash | |
| curl -L https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/cryptohopper-darwin-arm64 -o /usr/local/bin/cryptohopper | |
| chmod +x /usr/local/bin/cryptohopper | |
| ``` | |
| **macOS (Intel)** | |
| ```bash | |
| curl -L https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/cryptohopper-darwin-x64 -o /usr/local/bin/cryptohopper | |
| chmod +x /usr/local/bin/cryptohopper | |
| ``` | |
| **Linux x64** | |
| ```bash | |
| curl -L https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/cryptohopper-linux-x64 -o /usr/local/bin/cryptohopper | |
| chmod +x /usr/local/bin/cryptohopper | |
| ``` | |
| **Windows x64** | |
| Download `cryptohopper-windows-x64.exe`, rename to `cryptohopper.exe`, put it on `%PATH%`. | |
| > **First-launch warnings:** these binaries are **not yet code-signed**. macOS will block them with a Gatekeeper prompt — right-click → Open the first time, or run `xattr -d com.apple.quarantine /usr/local/bin/cryptohopper`. Windows will show a SmartScreen warning — click "More info" → "Run anyway". | |
| ## Verify | |
| ```bash | |
| sha256sum -c SHA256SUMS | |
| ``` | |
| Then run `cryptohopper login`. |