iframe-proxy | Sunbelt Computer Software

210 lines (181 loc) · 7.42 KB
name: 'nativescript -> npm'
    branches:
      - main
      - "v*"
    paths-ignore:
      - 'packages/**'
  workflow_dispatch:
    inputs:
      release_type:
        description: 'Release type. "dev" publishes a -next prerelease without bumping package.json. patch/minor/major/prerelease bump package.json, commit + tag to main, then publish as a stable release.'
        type: choice
        options:
          - dev
          - patch
          - minor
          - major
          - prerelease
        default: patch
permissions: read-all
  NPM_TAG: 'next'
    name: Build
    runs-on: macos-latest
    permissions:
      contents: write
    outputs:
      npm_version: ${{ steps.npm_version_output.outputs.NPM_VERSION }}
      npm_tag: ${{ steps.npm_version_output.outputs.NPM_TAG }}
      is_release: ${{ steps.npm_version_output.outputs.IS_RELEASE }}
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version: 22.14.0
          registry-url: "https://registry.npmjs.org"
      - name: Setup
        run: npm i --ignore-scripts --legacy-peer-deps --no-package-lock
      - name: Get Current Version
        run: |
          NPM_VERSION=$(node -e "console.log(require('./package.json').version);")
          echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV
      - name: Bump, commit and tag stable release (manual dispatch)
        if: ${{ github.event_name == 'workflow_dispatch' && inputs.release_type != 'dev' }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          npm version ${{ inputs.release_type }} -m "chore: release v%s"
          NPM_VERSION=$(node -e "console.log(require('./package.json').version);")
          echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV
          git push origin HEAD:${GITHUB_REF_NAME} --follow-tags
      - name: Bump version for dev release
        if: ${{ !contains(github.ref, 'refs/tags/') && (github.event_name != 'workflow_dispatch' || inputs.release_type == 'dev') }}
        env:
          NPM_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.release_type == 'dev' && 'dev' || 'next' }}
        run: |
          NPM_VERSION=$(node ./scripts/get-next-version.js)
          echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV
          npm version $NPM_VERSION --no-git-tag-version
      - name: Output NPM Version and tag
        id: npm_version_output
        run: |
          NPM_TAG=$(node ./scripts/get-npm-tag.js)
          if [[ "${GITHUB_REF}" == refs/tags/* ]] || [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ inputs.release_type }}" != "dev" ]]; then
            IS_RELEASE=true
          else
            IS_RELEASE=false
          echo NPM_VERSION=$NPM_VERSION >> $GITHUB_OUTPUT
          echo NPM_TAG=$NPM_TAG >> $GITHUB_OUTPUT
          echo IS_RELEASE=$IS_RELEASE >> $GITHUB_OUTPUT
      - name: Build nativescript
        run: npm pack
      - name: Upload npm package artifact
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: npm-package
          path: nativescript-${{steps.npm_version_output.outputs.NPM_VERSION}}.tgz
    runs-on: ubuntu-latest
    environment: npm-publish
      - build
    permissions:
      contents: read
      id-token: write
      NPM_VERSION: ${{needs.build.outputs.npm_version}}
      NPM_TAG: ${{needs.build.outputs.npm_tag}}
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit
      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version: 22.14.0
          registry-url: "https://registry.npmjs.org"
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-package
          path: dist
      - name: Update npm (required for OIDC trusted publishing)
        run: |
          npm install -g npm@^11.5.1
          npm --version
      - name: Publish package (OIDC trusted publishing)
        if: ${{ vars.USE_NPM_TOKEN != 'true' }}
        run: |
          echo "Publishing nativescript@$NPM_VERSION to NPM with tag $NPM_TAG via OIDC trusted publishing..."
          unset NODE_AUTH_TOKEN
          if [ -n "${NPM_CONFIG_USERCONFIG:-}" ]; then
            rm -f "$NPM_CONFIG_USERCONFIG"
          npm publish ./dist/nativescript-${{env.NPM_VERSION}}.tgz --tag $NPM_TAG --access public --provenance
        env:
          NODE_AUTH_TOKEN: ""
      - name: Publish package (granular token)
        if: ${{ vars.USE_NPM_TOKEN == 'true' }}
        run: |
          echo "Publishing nativescript@$NPM_VERSION to NPM with tag $NPM_TAG via granular token..."
          npm publish ./dist/nativescript-${{env.NPM_VERSION}}.tgz --tag $NPM_TAG --access public --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
  github-release:
    runs-on: ubuntu-latest
    # runs for tag pushes and for manual dispatches that bumped a stable release
    if: ${{ needs.build.outputs.is_release == 'true' }}
    permissions:
      contents: write
      - build
      NPM_VERSION: ${{needs.build.outputs.npm_version}}
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          ref: v${{needs.build.outputs.npm_version}}
      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version: 22.14.0
      - name: Setup
        run: npm i --ignore-scripts --legacy-peer-deps --no-package-lock
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-package
          path: dist
      - name: Generate provenance statement
        run: |
          TGZ_PATH=$(ls dist/nativescript-*.tgz | head -n1)
          TGZ_NAME=$(basename "$TGZ_PATH")
          TGZ_SHA=$(sha256sum "$TGZ_PATH" | awk '{ print $1 }')
          PROV_PATH="dist/${TGZ_NAME%.tgz}.intoto.jsonl"
          cat > "$PROV_PATH" <<EOF
          {"_type":"https://in-toto.io/Statement/v1","subject":[{"name":"$TGZ_NAME","digest":{"sha256":"$TGZ_SHA"}}],"predicateType":"https://slsa.dev/provenance/v1"}
          EOF
      - name: Partial Changelog
        run: npx conventional-changelog -p angular -r2 > body.md
      - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
        with:
          tag: v${{needs.build.outputs.npm_version}}
          artifacts: "dist/nativescript-*.tgz,dist/nativescript-*.intoto.jsonl"
          bodyFile: "body.md"
          prerelease: ${{needs.build.outputs.npm_tag != 'latest'}}
          allowUpdates: true
Sunbelt Computer Software

PL/B Language Development and Support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

Uh oh!

FilesExpand file tree

npm_release_cli.yml

Latest commit

History

npm_release_cli.yml

File metadata and controls
