Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Trust SDK to NPM | |
| on: | |
| push: | |
| tags: | |
| - 'v[0-9]+.[0-9]+.[0-9]+' | |
| - 'v[0-9]+.[0-9]+.[0-9]+-*' | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Version to publish (e.g., 1.0.0)' | |
| required: true | |
| type: string | |
| dry_run: | |
| description: 'Dry run (do not publish)' | |
| required: false | |
| type: boolean | |
| default: false | |
| env: | |
| NODE_VERSION: '20' | |
| jobs: | |
| validate: | |
| name: Validate & Build Package | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run linter | |
| run: npm run lint | |
| continue-on-error: true | |
| - name: Run formatter check | |
| run: npm run format -- --check | |
| continue-on-error: true | |
| - name: Type check | |
| run: npx tsc --noEmit | |
| - name: Run tests | |
| run: npm test | |
| continue-on-error: true | |
| - name: Build package | |
| run: npm run build | |
| - name: Verify build output | |
| run: | | |
| echo "Checking build output..." | |
| if [ ! -f dist/index.js ]; then | |
| echo "❌ Error: dist/index.js not found" | |
| exit 1 | |
| fi | |
| if [ ! -f dist/index.d.ts ]; then | |
| echo "❌ Error: dist/index.d.ts not found" | |
| exit 1 | |
| fi | |
| echo "✅ Build output verified successfully" | |
| - name: Verify package contents | |
| run: | | |
| echo "📦 Package contents preview:" | |
| npm pack --dry-run | |
| echo "" | |
| echo "📊 Verifying package size..." | |
| SIZE=$(npm pack --dry-run 2>&1 | grep "package size" | awk '{print $4, $5}') | |
| echo "Package size: $SIZE" | |
| echo "" | |
| echo "🔍 Ensuring source files are excluded..." | |
| if npm pack --dry-run 2>&1 | grep -q "src/"; then | |
| echo "❌ ERROR: Source files detected in package!" | |
| exit 1 | |
| fi | |
| echo "✅ Source files correctly excluded" | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dist-files-${{ github.sha }} | |
| path: dist/ | |
| retention-days: 7 | |
| publish: | |
| name: Publish to NPM | |
| runs-on: ubuntu-latest | |
| needs: validate | |
| if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && !inputs.dry_run) | |
| environment: | |
| name: npm-production | |
| url: https://www.npmjs.com/package/@open-agent-economy/trust-sdk | |
| permissions: | |
| contents: read | |
| id-token: write # Required for provenance | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| registry-url: 'https://registry.npmjs.org' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build package | |
| run: npm run build | |
| - name: Extract version from tag | |
| id: version | |
| run: | | |
| if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then | |
| VERSION="${{ inputs.version }}" | |
| else | |
| # Extract version from tag (v1.0.0 -> 1.0.0) | |
| VERSION="${GITHUB_REF#refs/tags/v}" | |
| fi | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "📌 Publishing version: $VERSION" | |
| - name: Verify version matches package.json | |
| run: | | |
| PACKAGE_VERSION=$(node -p "require('./package.json').version") | |
| TAG_VERSION="${{ steps.version.outputs.version }}" | |
| if [ "$PACKAGE_VERSION" != "$TAG_VERSION" ]; then | |
| echo "⚠️ Version mismatch detected!" | |
| echo "package.json: $PACKAGE_VERSION" | |
| echo "Tag version: $TAG_VERSION" | |
| echo "Updating package.json to match tag..." | |
| npm version $TAG_VERSION --no-git-tag-version | |
| else | |
| echo "✅ Version matches: $PACKAGE_VERSION" | |
| fi | |
| - name: Final package verification | |
| run: | | |
| echo "📋 Package information:" | |
| npm pack --dry-run | |
| echo "" | |
| echo "🔍 Final checks:" | |
| # Check version | |
| VERSION=$(node -p "require('./package.json').version") | |
| echo "✅ Version: $VERSION" | |
| # Check main entry | |
| MAIN=$(node -p "require('./package.json').main") | |
| if [ -f "$MAIN" ]; then | |
| echo "✅ Main entry exists: $MAIN" | |
| else | |
| echo "❌ Main entry missing: $MAIN" | |
| exit 1 | |
| fi | |
| # Check types entry | |
| TYPES=$(node -p "require('./package.json').types") | |
| if [ -f "$TYPES" ]; then | |
| echo "✅ Types entry exists: $TYPES" | |
| else | |
| echo "❌ Types entry missing: $TYPES" | |
| exit 1 | |
| fi | |
| - name: Publish to NPM with Provenance | |
| run: | | |
| echo "🚀 Publishing @open-agent-economy/trust-sdk@${{ steps.version.outputs.version }}" | |
| echo "📝 With cryptographic provenance attestation..." | |
| npm publish --provenance --access public | |
| echo "✅ Package published successfully!" | |
| - name: Verify publication | |
| run: | | |
| echo "⏳ Waiting 30 seconds for NPM registry to update..." | |
| sleep 30 | |
| VERSION="${{ steps.version.outputs.version }}" | |
| echo "🔍 Verifying package @open-agent-economy/trust-sdk@$VERSION..." | |
| # Try to fetch package info from NPM | |
| if npm view @open-agent-economy/trust-sdk@$VERSION version; then | |
| echo "✅ Package verified on NPM registry!" | |
| # Check provenance | |
| echo "" | |
| echo "🔐 Checking provenance..." | |
| npm view @open-agent-economy/trust-sdk@$VERSION --json | grep -q "attestations" && \ | |
| echo "✅ Provenance attestation found!" || \ | |
| echo "⚠️ Provenance attestation not yet available (may take a few minutes)" | |
| else | |
| echo "⚠️ Could not verify package yet. Check manually at:" | |
| echo "https://www.npmjs.com/package/@open-agent-economy/trust-sdk/v/$VERSION" | |
| fi | |
| - name: Create deployment summary | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| cat >> $GITHUB_STEP_SUMMARY << 'EOF' | |
| ## 🚀 Trust SDK Published Successfully! | |
| ### Package Information | |
| - **Package:** `@open-agent-economy/trust-sdk` | |
| - **Version:** `${{ steps.version.outputs.version }}` | |
| - **Registry:** NPM (public) | |
| - **Provenance:** ✅ Enabled | |
| - **Commit:** `${{ github.sha }}` | |
| - **Published:** $(date -u '+%Y-%m-%d %H:%M:%S UTC') | |
| ### 📦 Links | |
| - [NPM Package](https://www.npmjs.com/package/@open-agent-economy/trust-sdk) | |
| - [This Version](https://www.npmjs.com/package/@open-agent-economy/trust-sdk/v/${{ steps.version.outputs.version }}) | |
| - [Documentation](https://open-agent-economy.github.io/open-agent-trust/) | |
| - [Repository](https://github.com/Open-Agent-Economy/open-agent-trust) | |
| ### 💻 Installation | |
| ```bash | |
| npm install @open-agent-economy/trust-sdk@${{ steps.version.outputs.version }} | |
| ``` | |
| Or install latest: | |
| ```bash | |
| npm install @open-agent-economy/trust-sdk@latest | |
| ``` | |
| ### 🔐 Verify Provenance | |
| ```bash | |
| npm audit signatures | |
| ``` | |
| EOF | |
| create-release: | |
| name: Create GitHub Release | |
| runs-on: ubuntu-latest | |
| needs: publish | |
| if: github.event_name == 'push' | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Extract version from tag | |
| id: version | |
| run: | | |
| VERSION="${GITHUB_REF#refs/tags/v}" | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "tag=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT | |
| - name: Get previous tag | |
| id: prev_tag | |
| run: | | |
| PREV_TAG=$(git tag --sort=-version:refname | grep "^v" | sed -n '2p' || echo "") | |
| if [ -z "$PREV_TAG" ]; then | |
| echo "No previous tag found, using first commit" | |
| PREV_TAG=$(git rev-list --max-parents=0 HEAD) | |
| fi | |
| echo "prev_tag=$PREV_TAG" >> $GITHUB_OUTPUT | |
| echo "Previous tag: $PREV_TAG" | |
| - name: Generate changelog | |
| id: changelog | |
| run: | | |
| PREV_TAG="${{ steps.prev_tag.outputs.prev_tag }}" | |
| CURRENT_TAG="${{ steps.version.outputs.tag }}" | |
| echo "📝 Generating changelog from $PREV_TAG to $CURRENT_TAG..." | |
| # Generate commit list | |
| if [ "$PREV_TAG" = "$(git rev-list --max-parents=0 HEAD)" ]; then | |
| CHANGELOG=$(git log --pretty=format:"- %s (%h)" --no-merges) | |
| else | |
| CHANGELOG=$(git log $PREV_TAG..$CURRENT_TAG --pretty=format:"- %s (%h)" --no-merges) | |
| fi | |
| if [ -z "$CHANGELOG" ]; then | |
| CHANGELOG="- Initial release" | |
| fi | |
| # Save to file for multiline output | |
| echo "$CHANGELOG" > changelog.txt | |
| echo "✅ Changelog generated" | |
| - name: Create GitHub Release | |
| uses: actions/github-script@v7 | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| TAG: ${{ steps.version.outputs.tag }} | |
| with: | |
| script: | | |
| const fs = require('fs'); | |
| const version = process.env.VERSION; | |
| const tag = process.env.TAG; | |
| const changelog = fs.readFileSync('changelog.txt', 'utf8'); | |
| const isPrerelease = version.includes('-'); | |
| const body = `## 🚀 Trust SDK v${version} | |
| ### What's Changed | |
| ${changelog} | |
| ### 📦 Installation | |
| \`\`\`bash | |
| npm install @open-agent-economy/trust-sdk@${version} | |
| \`\`\` | |
| ### 🔐 Security | |
| This release includes cryptographic provenance attestation. Verify with: | |
| \`\`\`bash | |
| npm audit signatures | |
| \`\`\` | |
| ### 📚 Documentation | |
| - [Full Documentation](https://open-agent-economy.github.io/open-agent-trust/) | |
| - [Getting Started](https://open-agent-economy.github.io/open-agent-trust/guide/getting-started) | |
| - [API Reference](https://open-agent-economy.github.io/open-agent-trust/api/sdk-reference) | |
| ### 🔗 Links | |
| - 📦 [NPM Package](https://www.npmjs.com/package/@open-agent-economy/trust-sdk/v/${version}) | |
| - 📖 [Documentation](https://open-agent-economy.github.io/open-agent-trust/) | |
| - 🐛 [Report Issues](https://github.com/Open-Agent-Economy/open-agent-trust/issues) | |
| - 💬 [Discussions](https://github.com/Open-Agent-Economy/open-agent-trust/discussions) | |
| ### 🌐 Deployment (Base Sepolia) | |
| - Interaction Registry: \`0x12F5C3fD1893bf9b2DeaA43AE1A2CCb122C3E707\` | |
| - Attestation Registry: \`0x64DaE82fE64D2fE96f90017FE51069C107BFe9d5\` | |
| - Trust Graph: \`0x8DC39B04A9C32e16DD7bd8906a8ea0d9DE6cCbDF\` | |
| `; | |
| const release = await github.rest.repos.createRelease({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| tag_name: tag, | |
| name: `Trust SDK v${version}`, | |
| body: body, | |
| draft: false, | |
| prerelease: isPrerelease, | |
| generate_release_notes: false | |
| }); | |
| console.log(`✅ Release created: ${release.data.html_url}`); | |
| dry-run: | |
| name: Dry Run (No Publish) | |
| runs-on: ubuntu-latest | |
| needs: validate | |
| if: github.event_name == 'workflow_dispatch' && inputs.dry_run | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build package | |
| run: npm run build | |
| - name: Dry run publish | |
| run: | | |
| echo "🧪 Running dry-run publish (no actual publication)..." | |
| echo "" | |
| npm publish --dry-run | |
| echo "" | |
| echo "✅ Dry run completed successfully!" | |
| - name: Verify package contents | |
| run: | | |
| echo "📦 Creating actual tarball for inspection..." | |
| npm pack | |
| TARBALL=$(ls *.tgz) | |
| echo "📋 Tarball: $TARBALL" | |
| echo "" | |
| echo "📂 Contents:" | |
| tar -tzf $TARBALL | |
| echo "" | |
| echo "🔍 Checking for unwanted files..." | |
| if tar -tzf $TARBALL | grep -q "src/"; then | |
| echo "❌ WARNING: Source files found in package!" | |
| else | |
| echo "✅ No source files in package" | |
| fi | |
| if tar -tzf $TARBALL | grep -q "\.ts$" | grep -v "\.d\.ts$"; then | |
| echo "❌ WARNING: TypeScript source files found!" | |
| else | |
| echo "✅ No TypeScript source files" | |
| fi | |
| # Cleanup | |
| rm $TARBALL | |
| - name: Create summary | |
| run: | | |
| cat >> $GITHUB_STEP_SUMMARY << 'EOF' | |
| ## ✅ Dry Run Completed Successfully | |
| The package build and validation completed without errors. | |
| ### ⚠️ No Package Published | |
| This was a **dry run** - nothing was published to NPM. | |
| ### 📊 Package Information | |
| - **Version:** `${{ inputs.version }}` | |
| - **Package:** `@open-agent-economy/trust-sdk` | |
| - **Node Version:** `${{ env.NODE_VERSION }}` | |
| ### 🚀 To Publish For Real | |
| **Option 1: Via Git Tag** | |
| ```bash | |
| git tag v${{ inputs.version }} | |
| git push origin v${{ inputs.version }} | |
| ``` | |
| **Option 2: Manual Workflow** | |
| Run this workflow again with dry-run disabled. | |
| ### ✅ Validation Passed | |
| - Build completed successfully | |
| - Package contents verified | |
| - Source files excluded | |
| - TypeScript definitions included | |
| EOF |