ci(templates): pin npm version for consistent builds #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish npm | |
| on: | |
| push: | |
| branches: | |
| - main | |
| release: | |
| types: | |
| - published | |
| permissions: | |
| contents: read | |
| id-token: write | |
| concurrency: | |
| group: npm-publish-${{ github.event_name }}-${{ github.ref || github.event.release.tag_name || github.run_id }} | |
| cancel-in-progress: false | |
| jobs: | |
| publish-dev: | |
| if: github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: package-lock.json | |
| registry-url: https://registry.npmjs.org | |
| - name: Detect npm auth mode | |
| id: auth | |
| env: | |
| NPM_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| run: | | |
| if [ -n "$NPM_TOKEN" ]; then | |
| echo "mode=token" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "mode=trusted-publisher" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Resolve development version | |
| id: version | |
| run: | | |
| version="$(npm run --silent publish:resolve-dev-version)" | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| - name: Stamp development package version | |
| env: | |
| DEV_VERSION: ${{ steps.version.outputs.version }} | |
| run: npm version --no-git-tag-version "$DEV_VERSION" | |
| - name: Verify publish readiness | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| run: npm run publish:verify-readiness | |
| - name: Build package | |
| run: npm run build | |
| - name: Typecheck package | |
| run: npm run typecheck | |
| - name: Run tests | |
| run: npm test | |
| - name: Verify packed files | |
| run: npm run pack:check | |
| - name: Publish to npm dev dist-tag with token | |
| if: steps.auth.outputs.mode == 'token' | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| run: npm publish --tag dev --provenance --access public | |
| - name: Publish to npm dev dist-tag with trusted publisher | |
| if: steps.auth.outputs.mode == 'trusted-publisher' | |
| run: npm publish --tag dev --provenance --access public | |
| - name: Summarize publish result | |
| run: | | |
| { | |
| echo "## npm dev publish" | |
| echo | |
| echo "- Package: @hagicode/skillsbase" | |
| echo "- Version: ${{ steps.version.outputs.version }}" | |
| echo "- Dist-tag: dev" | |
| echo "- Auth mode: ${{ steps.auth.outputs.mode }}" | |
| echo "- Registry: npmjs.org" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| publish-release: | |
| if: github.event_name == 'release' && github.event.action == 'published' && !github.event.release.prerelease && !github.event.release.draft | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.release.tag_name }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: package-lock.json | |
| registry-url: https://registry.npmjs.org | |
| - name: Detect npm auth mode | |
| id: auth | |
| env: | |
| NPM_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| run: | | |
| if [ -n "$NPM_TOKEN" ]; then | |
| echo "mode=token" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "mode=trusted-publisher" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Resolve stable release version | |
| id: version | |
| run: | | |
| version="$(npm run --silent publish:verify-release -- "${{ github.event.release.tag_name }}")" | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| echo "Resolved stable release version: $version" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Stamp stable package version | |
| env: | |
| RELEASE_VERSION: ${{ steps.version.outputs.version }} | |
| run: npm version --no-git-tag-version "$RELEASE_VERSION" | |
| - name: Verify publish readiness | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| run: npm run publish:verify-readiness | |
| - name: Build package | |
| run: npm run build | |
| - name: Typecheck package | |
| run: npm run typecheck | |
| - name: Run tests | |
| run: npm test | |
| - name: Verify packed files | |
| run: npm run pack:check | |
| - name: Publish to npm latest dist-tag with token | |
| if: steps.auth.outputs.mode == 'token' | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| run: npm publish --tag latest --provenance --access public | |
| - name: Publish to npm latest dist-tag with trusted publisher | |
| if: steps.auth.outputs.mode == 'trusted-publisher' | |
| run: npm publish --tag latest --provenance --access public | |
| - name: Summarize publish result | |
| run: | | |
| { | |
| echo "## npm stable publish" | |
| echo | |
| echo "- Package: @hagicode/skillsbase" | |
| echo "- Version: ${{ steps.version.outputs.version }}" | |
| echo "- Dist-tag: latest" | |
| echo "- Auth mode: ${{ steps.auth.outputs.mode }}" | |
| echo "- Release: ${{ github.event.release.html_url }}" | |
| echo "- Tag: ${{ github.event.release.tag_name }}" | |
| echo "- Registry: npmjs.org" | |
| } >> "$GITHUB_STEP_SUMMARY" |