Simon
4c76a5f1d2
npm@latest now resolves to npm 12, whose install-time security defaults break the release pipeline.
46 lines
1.1 KiB
YAML
46 lines
1.1 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
permissions:
|
|
id-token: write # Required for OIDC
|
|
contents: read
|
|
|
|
jobs:
|
|
release:
|
|
# Only the repo owner may trigger a release, even if tag protection is bypassed
|
|
if: github.actor == 'gaomeng1900'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: 24
|
|
registry-url: 'https://registry.npmjs.org'
|
|
|
|
# Stay on the latest npm 11 release
|
|
- name: Update npm
|
|
run: npm install -g npm@11
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build
|
|
run: npm run build:libs
|
|
|
|
- name: Publish all public packages
|
|
run: |
|
|
VERSION=${GITHUB_REF#refs/tags/v}
|
|
if [[ "$VERSION" == *"-"* ]]; then
|
|
# Prerelease version (e.g., 0.3.0-beta.1) -> extract tag name before the dot
|
|
TAG=$(echo "$VERSION" | sed 's/.*-\([a-zA-Z]*\).*/\1/')
|
|
npm publish --workspaces --access public --tag "$TAG"
|
|
else
|
|
npm publish --workspaces --access public
|
|
fi
|