Repository navigation
118 lines (100 loc) · 4.16 KB
/
Copy pathrelease.yml
File metadata and controls
118 lines (100 loc) · 4.16 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
name: Release to npm (provenance + signed assets)
on:
workflow_dispatch:
release:
types: [published]
permissions:
contents: read
id-token: write
jobs:
publish:
if: github.repository == 'opencue/gitguardex'
runs-on: ubuntu-latest
environment: npm
permissions:
contents: write
id-token: write
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # npm run verify compares new files with origin/main.
- name: Setup Node
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
registry-url: https://registry.npmjs.org
package-manager-cache: false
- name: Verify npm trusted-publishing support
run: |
npm_version="$(npm --version)"
node - "$npm_version" <<'NODE'
const version = process.argv[2];
const [major = 0, minor = 0, patch = 0] = version.split('.').map(Number);
const supported = major > 11 || (major === 11 && (minor > 5 || (minor === 5 && patch >= 1)));
if (!supported) {
console.error(`npm ${version} cannot use OIDC trusted publishing; requires npm >=11.5.1`);
process.exit(1);
}
NODE
- name: Install Cosign
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
- name: Install
run: npm ci --ignore-scripts
- name: Verify
run: npm run verify
- name: Audit dependencies
run: scripts/npm-audit-retry.sh --audit-level=high
- name: Resolve package metadata
id: pkg
run: |
echo "name=$(node -p "require('./package.json').name")" >> "$GITHUB_OUTPUT"
echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
- name: Check npm registry for current version
id: registry
env:
PACKAGE_NAME: ${{ steps.pkg.outputs.name }}
PACKAGE_VERSION: ${{ steps.pkg.outputs.version }}
run: |
if npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" version >/dev/null 2>&1; then
echo "already_published=true" >> "$GITHUB_OUTPUT"
else
echo "already_published=false" >> "$GITHUB_OUTPUT"
fi
- name: Pack release tarball
id: pack
run: |
mkdir -p dist
package_file="$(npm pack --pack-destination dist | tail -n 1)"
echo "package_file=${package_file}" >> "$GITHUB_OUTPUT"
echo "package_path=dist/${package_file}" >> "$GITHUB_OUTPUT"
- name: Publish with provenance
if: ${{ steps.registry.outputs.already_published != 'true' }}
run: npm publish --provenance --access public
- name: Skip already-published npm version
if: ${{ steps.registry.outputs.already_published == 'true' }}
env:
PACKAGE_NAME: ${{ steps.pkg.outputs.name }}
PACKAGE_VERSION: ${{ steps.pkg.outputs.version }}
run: echo "${PACKAGE_NAME}@${PACKAGE_VERSION} is already on npm; skipping publish."
- name: Generate release checksum
if: ${{ always() && steps.pack.outputs.package_path != '' }}
run: |
sha256sum "${{ steps.pack.outputs.package_path }}" > "${{ steps.pack.outputs.package_path }}.sha256"
- name: Sign release tarball with Sigstore
if: ${{ always() && steps.pack.outputs.package_path != '' }}
run: |
cosign sign-blob "${{ steps.pack.outputs.package_path }}" \
--bundle "${{ steps.pack.outputs.package_path }}.sigstore.json" \
--yes
- name: Upload signed release assets
if: ${{ always() && steps.pack.outputs.package_path != '' }}
env:
GH_TOKEN: ${{ github.token }}
RELEASE_TAG: ${{ github.event.release.tag_name || format('v{0}', steps.pkg.outputs.version) }}
run: |
gh release upload "$RELEASE_TAG" \
"${{ steps.pack.outputs.package_path }}" \
"${{ steps.pack.outputs.package_path }}.sha256" \
"${{ steps.pack.outputs.package_path }}.sigstore.json" \
--clobber