publish executor v1.6.10 #223

Workflow file for this run

.github/workflows/publish-executor-package.yml at 3890d6f

	name: Publish Executor
	run-name: "${{ format('publish executor {0}', github.event_name == 'workflow_dispatch' && inputs.tag \|\| github.ref_name) }}"

	on:
	# Release pushes a validated v* tag and lets this trigger handle automatic
	# publishing. workflow_dispatch stays available for explicit repair runs.
	push:
	tags:
	- "v*"
	workflow_dispatch:
	inputs:
	tag:
	description: Git tag to publish
	required: true
	type: string

	permissions:
	contents: read

	concurrency:
	group: publish-executor-package-${{ github.ref }}
	cancel-in-progress: false

	# CI is not a user — see the note in ci.yml. Applied to every workflow rather
	# than the ones that look like they run product code: the first pass guessed,
	# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert
	# where the product is not executed, so the blanket application is the cheap
	# structural answer.
	env:
	DO_NOT_TRACK: "1"
	EXECUTOR_DISABLE_ANALYTICS: "1"
	EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"

	jobs:
	publish:
	runs-on: ubuntu-latest
	permissions:
	actions: write
	contents: write
	id-token: write

	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0
	persist-credentials: false

	- name: Setup Bun
	uses: oven-sh/setup-bun@v2
	with:
	bun-version: 1.3.11

	- name: Validate release tag
	env:
	RAW_RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag \|\| github.ref_name }}
	run: bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG

	- name: Checkout release tag
	env:
	GH_TOKEN: ${{ secrets.RELEASE_PAT \|\| github.token }}
	run: \|
	auth_remote="https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
	git fetch --force --tags "$auth_remote" "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
	git checkout --detach "$RELEASE_TAG"

	- name: Setup Node
	uses: actions/setup-node@v4
	with:
	node-version: 24
	registry-url: https://registry.npmjs.org

	- name: Update npm for trusted publishing
	run: \|
	# npm 12.0.0 fails `publish --provenance` with "Cannot find module
	# 'sigstore'" (npm/cli#9722); 11.x supports trusted publishing and works.
	npm install -g npm@11
	npm --version

	- name: Install dependencies
	run: bun install --frozen-lockfile

	- name: Run release checks
	run: bun run release:check

	# --skip-build reuses the artifacts release:check's dry-run just built
	# in this same tree (validated against the release version) instead of
	# rebuilding everything a second time.
	- name: Stage release artifacts and draft GitHub release
	env:
	GH_TOKEN: ${{ github.token }}
	run: \|
	export GITHUB_REF_TYPE=tag
	export GITHUB_REF_NAME="$RELEASE_TAG"
	export GITHUB_REF="refs/tags/$RELEASE_TAG"
	bun run --cwd apps/cli src/release.ts --stage-only --skip-build

	# Desktop needs only the tag and the draft release staged above — it
	# compiles its own sidecar from the tag's source. Triggering it before
	# the npm publishes overlaps its build with them; its release job waits
	# for THIS run (by the id passed here) to succeed before promoting the
	# release, so a failed npm publish still leaves the release in draft.
	- name: Trigger desktop build
	env:
	GH_TOKEN: ${{ github.token }}
	run: gh workflow run publish-desktop.yml -f tag="$RELEASE_TAG" -f executor_run_id="$GITHUB_RUN_ID"

	- name: Publish executor to npm
	run: \|
	export GITHUB_REF_TYPE=tag
	export GITHUB_REF_NAME="$RELEASE_TAG"
	export GITHUB_REF="refs/tags/$RELEASE_TAG"
	bun run --cwd apps/cli src/release.ts --publish-only

	- name: Trigger self-host Docker publish
	env:
	GH_TOKEN: ${{ github.token }}
	run: gh workflow run publish-selfhost-docker.yml -f tag="$RELEASE_TAG"

Navigation Menu

publish executor v1.6.10 #223

Workflow file

publish executor v1.6.10 #223

Uh oh!

Workflow file for this run