Separate staging credentials from production #10
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| on: | |
| push: | |
| tags: ["v*"] | |
| permissions: {} | |
| concurrency: | |
| group: npm-publish | |
| cancel-in-progress: false | |
| jobs: | |
| verify: | |
| name: Verify release | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| actions: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24.18.0 | |
| package-manager-cache: false | |
| - name: Verify tag and source commit | |
| run: bash scripts/check-release-source.sh | |
| - name: Reuse successful CI for this source | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| release_sha="$(git rev-parse 'HEAD^{commit}')" | |
| ci_url="$(gh run list --repo "$GITHUB_REPOSITORY" --workflow ci.yml \ | |
| --branch main --event push --commit "$release_sha" --status success \ | |
| --limit 1 --json url --jq '.[0].url // empty')" | |
| test -n "$ci_url" || { echo "No successful main CI run for $release_sha." >&2; exit 1; } | |
| echo "Reusing $ci_url" | |
| - run: npm run pack:check | |
| publish: | |
| name: Publish to npm | |
| needs: verify | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| environment: npm | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24.18.0 | |
| package-manager-cache: false | |
| registry-url: https://registry.npmjs.org/ | |
| - name: Verify approved release | |
| env: | |
| NPM_RELEASE_ENABLED: ${{ vars.NPM_RELEASE_ENABLED }} | |
| # Recheck mutable refs after environment approval, without rerunning CI. | |
| run: | | |
| set -euo pipefail | |
| test "$NPM_RELEASE_ENABLED" = "true" | |
| bash scripts/check-release-source.sh | |
| - name: Publish verified source with OIDC | |
| run: npm publish --access public --tag latest --provenance --ignore-scripts |