Publish #118
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| package: | |
| description: "Which package set to publish" | |
| required: true | |
| type: choice | |
| options: | |
| - bailian-cli | |
| - knowledge-studio-cli | |
| mode: | |
| description: "Publish mode" | |
| required: true | |
| type: choice | |
| options: | |
| - channel | |
| - stable | |
| channel: | |
| description: "Required when mode=channel. dist-tag name, e.g. mcp / plugin / release-test (lowercase, digits, dashes)" | |
| required: false | |
| type: string | |
| concurrency: | |
| group: publish-${{ inputs.package }}-${{ inputs.mode }}-${{ inputs.channel }} | |
| cancel-in-progress: false | |
| jobs: | |
| publish-stable: | |
| if: inputs.mode == 'stable' | |
| name: publish stable (${{ inputs.package }}) to npm + binary + tag | |
| runs-on: ubuntu-latest | |
| environment: production # Required Reviewers gate | |
| permissions: | |
| contents: write # push tag + create GitHub Release with binary assets | |
| id-token: write # OIDC for npm Trusted Publishing + provenance | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24" | |
| cache: pnpm | |
| registry-url: "https://registry.npmjs.org/" | |
| - name: Install gitleaks | |
| run: | | |
| set -euo pipefail | |
| GITLEAKS_VERSION=8.21.2 | |
| curl -sSfL \ | |
| "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | sudo tar -xz -C /usr/local/bin gitleaks | |
| gitleaks version | |
| - name: Ensure zip (per-platform binary archives) | |
| run: sudo apt-get update && sudo apt-get install -y zip | |
| - run: pnpm install --frozen-lockfile | |
| # Binary compile uses `bun build --compile` CLI (not Bun.build API). | |
| # Keep this pin in sync with any local smoke tests of binary-compile.mjs. | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.2.19" | |
| - name: publish-stable | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Optional: HTTP trigger for external FC (GitHub Release → OSS). Leave unset to skip. | |
| BAILIAN_OSS_SYNC_WEBHOOK: ${{ secrets.BAILIAN_OSS_SYNC_WEBHOOK }} | |
| run: node tools/release/publish-stable.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }} | |
| publish-channel: | |
| if: inputs.mode == 'channel' | |
| name: publish channel (${{ inputs.package }}) to npm + binary | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # create prerelease GitHub Release with binary assets | |
| id-token: write # OIDC for npm Trusted Publishing + provenance | |
| steps: | |
| - name: Require channel input | |
| if: ${{ inputs.channel == '' }} | |
| run: | | |
| echo "::error::mode=channel requires the workflow input \"channel\" (e.g. mcp, plugin, release-test). Leave mode=stable if you do not need a dist-tag." | |
| exit 1 | |
| - uses: actions/checkout@v6 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24" | |
| cache: pnpm | |
| registry-url: "https://registry.npmjs.org/" | |
| - name: Install gitleaks | |
| run: | | |
| set -euo pipefail | |
| GITLEAKS_VERSION=8.21.2 | |
| curl -sSfL \ | |
| "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | sudo tar -xz -C /usr/local/bin gitleaks | |
| gitleaks version | |
| - name: Ensure zip (per-platform binary archives) | |
| run: sudo apt-get update && sudo apt-get install -y zip | |
| - run: pnpm install --frozen-lockfile | |
| # Binary compile uses `bun build --compile` CLI (not Bun.build API). | |
| # Keep this pin in sync with any local smoke tests of binary-compile.mjs. | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.2.19" | |
| - name: publish-channel | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| BAILIAN_OSS_SYNC_WEBHOOK: ${{ secrets.BAILIAN_OSS_SYNC_WEBHOOK }} | |
| run: node tools/release/publish-channel.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }} --channel "${{ inputs.channel }}" |