nativescript -> npm #314
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'nativescript -> npm' | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "v*" | |
| paths-ignore: | |
| - 'packages/**' | |
| workflow_dispatch: | |
| inputs: | |
| release_type: | |
| description: >- | |
| Release to cut. Leave empty for a rolling "next" prerelease (no version | |
| bump). "dev" publishes a -dev prerelease (no bump). A semver keyword | |
| (patch/minor/major) or an explicit version (e.g. 9.1.0, 9.1.0-alpha.1) | |
| bumps package.json, commits + tags v<version>, then publishes a stable | |
| release. A prerelease version publishes under the dist-tag matching its | |
| prerelease id (alpha/beta/rc); a plain version publishes under "latest". | |
| type: string | |
| required: false | |
| default: '' | |
| permissions: read-all | |
| env: | |
| NPM_TAG: 'next' | |
| jobs: | |
| build: | |
| name: Build | |
| runs-on: macos-latest | |
| permissions: | |
| contents: write | |
| outputs: | |
| npm_version: ${{ steps.npm_version_output.outputs.NPM_VERSION }} | |
| npm_tag: ${{ steps.npm_version_output.outputs.NPM_TAG }} | |
| is_release: ${{ steps.npm_version_output.outputs.IS_RELEASE }} | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0 | |
| with: | |
| node-version: 22.14.0 | |
| registry-url: "https://registry.npmjs.org" | |
| - name: Setup | |
| run: npm i --ignore-scripts --legacy-peer-deps --no-package-lock | |
| - name: Get Current Version | |
| run: | | |
| NPM_VERSION=$(node -e "console.log(require('./package.json').version);") | |
| echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV | |
| - name: Bump, commit and tag stable release (manual dispatch) | |
| if: ${{ github.event_name == 'workflow_dispatch' && inputs.release_type != '' && inputs.release_type != 'dev' }} | |
| env: | |
| # env indirection keeps the free-text dispatch input out of shell interpolation | |
| RELEASE_INPUT: ${{ inputs.release_type }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| # npm version accepts a semver keyword (patch/minor/major) or an explicit | |
| # version; strip an optional leading "v" so v9.1.0 and 9.1.0 both work. | |
| npm version "${RELEASE_INPUT#v}" -m "chore: release v%s" | |
| NPM_VERSION=$(node -e "console.log(require('./package.json').version);") | |
| echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV | |
| git push origin HEAD:${GITHUB_REF_NAME} --follow-tags | |
| - name: Bump version for dev release | |
| if: ${{ !contains(github.ref, 'refs/tags/') && (github.event_name != 'workflow_dispatch' || inputs.release_type == '' || inputs.release_type == 'dev') }} | |
| env: | |
| NPM_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.release_type == 'dev' && 'dev' || 'next' }} | |
| run: | | |
| NPM_VERSION=$(node ./scripts/get-next-version.js) | |
| echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV | |
| npm version $NPM_VERSION --no-git-tag-version | |
| - name: Output NPM Version and tag | |
| id: npm_version_output | |
| env: | |
| # true only for a manual dispatch that cut a real (bumped) release — not | |
| # the empty "next" build or the "dev" channel. Computed in the GitHub | |
| # expression context so the free-text input never reaches the shell. | |
| IS_DISPATCH_RELEASE: ${{ github.event_name == 'workflow_dispatch' && inputs.release_type != '' && inputs.release_type != 'dev' }} | |
| run: | | |
| NPM_TAG=$(node ./scripts/get-npm-tag.js) | |
| if [[ "${GITHUB_REF}" == refs/tags/* ]] || [[ "$IS_DISPATCH_RELEASE" == "true" ]]; then | |
| IS_RELEASE=true | |
| else | |
| IS_RELEASE=false | |
| fi | |
| echo NPM_VERSION=$NPM_VERSION >> $GITHUB_OUTPUT | |
| echo NPM_TAG=$NPM_TAG >> $GITHUB_OUTPUT | |
| echo IS_RELEASE=$IS_RELEASE >> $GITHUB_OUTPUT | |
| - name: Build nativescript | |
| run: npm pack | |
| - name: Upload npm package artifact | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 | |
| with: | |
| name: npm-package | |
| path: nativescript-${{steps.npm_version_output.outputs.NPM_VERSION}}.tgz | |
| publish: | |
| runs-on: ubuntu-latest | |
| environment: npm-publish | |
| needs: | |
| - build | |
| permissions: | |
| contents: read | |
| id-token: write | |
| env: | |
| NPM_VERSION: ${{needs.build.outputs.npm_version}} | |
| NPM_TAG: ${{needs.build.outputs.npm_tag}} | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0 | |
| with: | |
| node-version: 22.14.0 | |
| registry-url: "https://registry.npmjs.org" | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: npm-package | |
| path: dist | |
| - name: Update npm (required for OIDC trusted publishing) | |
| run: | | |
| npm install -g npm@^11.5.1 | |
| npm --version | |
| - name: Publish package (OIDC trusted publishing) | |
| if: ${{ vars.USE_NPM_TOKEN != 'true' }} | |
| run: | | |
| echo "Publishing nativescript@$NPM_VERSION to NPM with tag $NPM_TAG via OIDC trusted publishing..." | |
| unset NODE_AUTH_TOKEN | |
| if [ -n "${NPM_CONFIG_USERCONFIG:-}" ]; then | |
| rm -f "$NPM_CONFIG_USERCONFIG" | |
| fi | |
| npm publish ./dist/nativescript-${{env.NPM_VERSION}}.tgz --tag $NPM_TAG --access public --provenance | |
| env: | |
| NODE_AUTH_TOKEN: "" | |
| - name: Publish package (granular token) | |
| if: ${{ vars.USE_NPM_TOKEN == 'true' }} | |
| run: | | |
| echo "Publishing nativescript@$NPM_VERSION to NPM with tag $NPM_TAG via granular token..." | |
| npm publish ./dist/nativescript-${{env.NPM_VERSION}}.tgz --tag $NPM_TAG --access public --provenance | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }} | |
| github-release: | |
| runs-on: ubuntu-latest | |
| # runs for tag pushes and for manual dispatches that bumped a stable release | |
| if: ${{ needs.build.outputs.is_release == 'true' }} | |
| permissions: | |
| contents: write | |
| needs: | |
| - build | |
| env: | |
| NPM_VERSION: ${{needs.build.outputs.npm_version}} | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| ref: v${{needs.build.outputs.npm_version}} | |
| - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0 | |
| with: | |
| node-version: 22.14.0 | |
| - name: Setup | |
| run: npm i --ignore-scripts --legacy-peer-deps --no-package-lock | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: npm-package | |
| path: dist | |
| - name: Generate provenance statement | |
| run: | | |
| TGZ_PATH=$(ls dist/nativescript-*.tgz | head -n1) | |
| TGZ_NAME=$(basename "$TGZ_PATH") | |
| TGZ_SHA=$(sha256sum "$TGZ_PATH" | awk '{ print $1 }') | |
| PROV_PATH="dist/${TGZ_NAME%.tgz}.intoto.jsonl" | |
| cat > "$PROV_PATH" <<EOF | |
| {"_type":"https://in-toto.io/Statement/v1","subject":[{"name":"$TGZ_NAME","digest":{"sha256":"$TGZ_SHA"}}],"predicateType":"https://slsa.dev/provenance/v1"} | |
| EOF | |
| - name: Partial Changelog | |
| run: npx conventional-changelog -p angular -r2 > body.md | |
| - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 | |
| with: | |
| tag: v${{needs.build.outputs.npm_version}} | |
| artifacts: "dist/nativescript-*.tgz,dist/nativescript-*.intoto.jsonl" | |
| bodyFile: "body.md" | |
| prerelease: ${{needs.build.outputs.npm_tag != 'latest'}} | |
| allowUpdates: true |