Publish npm Package #16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish npm Package | |
| on: | |
| push: | |
| tags: | |
| - "V*" | |
| # Manual npm-only publish for CLI hotfixes that do not need the full | |
| # V* tag release (popular apps, Docker). Version files must already be | |
| # bumped on main. Manual publishing is bound to an exact commit and its | |
| # successful cross-platform Quality & Testing run. | |
| workflow_dispatch: | |
| inputs: | |
| expected_sha: | |
| description: Exact main commit to publish | |
| required: true | |
| type: string | |
| quality_run_id: | |
| description: Successful Quality & Testing run for expected_sha | |
| required: true | |
| type: string | |
| permissions: | |
| actions: read | |
| contents: read | |
| id-token: write | |
| concurrency: | |
| group: npm-publish-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| name: Publish pake-cli | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Check manual publish source and quality gate | |
| if: github.event_name == 'workflow_dispatch' | |
| env: | |
| EXPECTED_SHA: ${{ inputs.expected_sha }} | |
| GH_TOKEN: ${{ github.token }} | |
| QUALITY_RUN_ID: ${{ inputs.quality_run_id }} | |
| run: | | |
| if [ "$GITHUB_REF" != "refs/heads/main" ]; then | |
| echo "Manual npm publish must run from main, got ${GITHUB_REF}." | |
| exit 1 | |
| fi | |
| if [ "$GITHUB_SHA" != "$EXPECTED_SHA" ]; then | |
| echo "Manual npm publish expected ${EXPECTED_SHA}, but main resolved to ${GITHUB_SHA}." | |
| exit 1 | |
| fi | |
| QUALITY_WORKFLOW_ID="$(gh api "repos/${GITHUB_REPOSITORY}/actions/workflows/quality-and-test.yml" --jq '.id')" | |
| RUN_JSON="$(gh run view "$QUALITY_RUN_ID" --repo "$GITHUB_REPOSITORY" --json event,headBranch,headSha,status,conclusion,workflowDatabaseId)" | |
| RUN_EVENT="$(jq -r '.event' <<<"$RUN_JSON")" | |
| RUN_BRANCH="$(jq -r '.headBranch' <<<"$RUN_JSON")" | |
| RUN_SHA="$(jq -r '.headSha' <<<"$RUN_JSON")" | |
| RUN_STATUS="$(jq -r '.status' <<<"$RUN_JSON")" | |
| RUN_CONCLUSION="$(jq -r '.conclusion' <<<"$RUN_JSON")" | |
| RUN_WORKFLOW_ID="$(jq -r '.workflowDatabaseId' <<<"$RUN_JSON")" | |
| if [ "$RUN_WORKFLOW_ID" != "$QUALITY_WORKFLOW_ID" ] || [ "$RUN_EVENT" != "push" ] || [ "$RUN_BRANCH" != "main" ] || [ "$RUN_SHA" != "$EXPECTED_SHA" ] || [ "$RUN_STATUS" != "completed" ] || [ "$RUN_CONCLUSION" != "success" ]; then | |
| echo "Quality run ${QUALITY_RUN_ID} does not prove ${EXPECTED_SHA}: ${RUN_JSON}" | |
| exit 1 | |
| fi | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: "10.26.2" | |
| run_install: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24" | |
| registry-url: "https://registry.npmjs.org" | |
| package-manager-cache: false | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Check release version | |
| run: node scripts/check-release-version.mjs "${{ github.ref_type == 'tag' && github.ref_name || '' }}" | |
| - name: Check formatting | |
| run: pnpm run format:check | |
| - name: Run unit tests | |
| run: npx vitest run | |
| - name: Build CLI | |
| run: pnpm run cli:build | |
| - name: Check package contents | |
| run: npm pack --dry-run --ignore-scripts | |
| - name: Publish to npm | |
| run: npm publish | |
| - name: Verify published version | |
| run: | | |
| VERSION="$(node -p "require('./package.json').version")" | |
| for attempt in {1..12}; do | |
| PUBLISHED="$(npm view "pake-cli@${VERSION}" version --registry=https://registry.npmjs.org 2>/dev/null || true)" | |
| if [ "$PUBLISHED" = "$VERSION" ]; then | |
| echo "Published pake-cli@${VERSION}" | |
| exit 0 | |
| fi | |
| echo "Waiting for npm registry to expose pake-cli@${VERSION} (attempt ${attempt}/12)" | |
| sleep 10 | |
| done | |
| echo "pake-cli@${VERSION} was not visible in npm registry after publish" | |
| exit 1 |