node-common/.github/workflows/release.yml at main · dailydotdev/node-common · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
name: release
run-name: >-
  release `${{ github.event.inputs.version }}` version
  ${{ github.ref_name != 'main' && format(' on `{0}`', github.ref_name) || '' }}

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version'
        required: true
        default: 'patch'
        type: choice
        options:
          - 'major'
          - 'minor'
          - 'patch'

permissions:
  id-token: write  # Required for OIDC
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write # Enable OIDC
      pull-requests: write
      contents: write

    steps:
      - uses: actions/checkout@v6

      - uses: chainguard-dev/actions/setup-gitsign@main

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: 'pnpm'
          registry-url: 'https://registry.npmjs.org'

      - name: Cache node_modules
        id: cache-node_modules
        uses: actions/cache@v5
        with:
          path: node_modules
          key: pnpm-${{ runner.os }}-node_modules-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            pnpm-${{ runner.os }}-node_modules-
            pnpm-${{ runner.os }}-

      - name: Install dependencies
        if: steps.cache-node_modules.outputs.cache-hit != 'true'
        run: |
          pnpm install --frozen-lockfile

      - name: Setup git
        run: |
          git config --global tag.gpgsign true

      - name: Bump version
        run: |
          pnpm version ${{ github.event.inputs.version }} --sign-git-tag

      - name: Publish to npm
        run: |
          set -euo pipefail

          BRANCH="${GITHUB_REF_NAME}"

          if [ "$BRANCH" = "main" ]; then
            echo "Branch=$BRANCH, publishing with default dist-tag (latest)"
            pnpm publish --access public --provenance
            exit 0
          fi

          if echo "$BRANCH" | grep -Eq '^release/[0-9]+\.[0-9]+$'; then
            MM="$(echo "$BRANCH" | sed -E 's|^release/([0-9]+\.[0-9]+)$|\1|')"
            TAG="backport-${MM}"
            echo "Branch=$BRANCH, publishing with dist-tag $TAG"
            pnpm publish --access public --provenance --tag "$TAG"
            exit 0
          fi

          echo "Branch=$BRANCH, publishing with dist-tag next"
          pnpm publish --access public --provenance --tag next

      - name: Push changes
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          VERSION=$(node -p "require('./package.json').version")
          git push --follow-tags
          gh release create "v${VERSION}" --generate-notes