mirror of
https://github.com/Twigpine/zero.git
synced 2026-11-09 18:08:31 -10:00
Kevin Codexandcoderabbitai[bot]
8eccc26698
* feat: publish zero to npm via release-please Adds release-please to automate versioning and releases from conventional commits on main: - release-please-config.json / .release-please-manifest.json: node release type (package.json is the version source of truth), plain v-prefixed tags, bootstrap-sha at current HEAD, and release-as 0.1.0 to pin the first release (remove after v0.1.0 ships). - .github/workflows/release-please.yml: maintains the release PR; on merge it tags + creates the GitHub Release, then dispatches release-artifacts.yml at the tag (GITHUB_TOKEN-created tags cannot fire on-push-tags workflows). - .github/workflows/release-artifacts.yml: tag-gated steps now match the ref instead of the push event so the dispatched-at-tag run publishes assets, and a new publish-npm job publishes @gitlawb/zero after verifying every postinstall asset URL is publicly downloadable (also blocks publishing while the repo is private). * Update .github/workflows/release-please.yml Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * feat: publish to npm via OIDC trusted publishing instead of NPM_TOKEN npm's trusted publishing exchanges the workflow's OIDC token for publish auth, so no long-lived NPM_TOKEN secret exists to leak, and provenance is generated automatically. Drops registry-url from setup-node (its .npmrc line hard-fails on the unset NODE_AUTH_TOKEN) and updates npm first (OIDC needs npm >= 11.5.1). One-time caveat: npm only lets you configure a trusted publisher on an existing package, so the first @gitlawb/zero publish is a manual bootstrap. * fix: drop npm@latest from the OIDC publish path Rely on the npm bundled with the pinned Node 24 toolchain (>= 11.5.1, the trusted-publishing minimum) instead of pulling an unpinned npm@latest from the registry inside the publish job, and fail fast with a clear error if a future toolchain change regresses it. --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
36 lines
1.3 KiB
YAML
36 lines
1.3 KiB
YAML
name: Release Please
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
permissions:
|
|
contents: write # push the release-PR branch, create the tag + GitHub Release
|
|
pull-requests: write # open/update the release PR
|
|
issues: write # create/apply release-tracking labels on the release PR
|
|
actions: write # dispatch release-artifacts.yml once a release is cut
|
|
|
|
jobs:
|
|
release-please:
|
|
name: Release PR / tag
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Run release-please
|
|
id: release
|
|
uses: googleapis/release-please-action@a02a34c4d625f9be7cb89156071d8567266a2445 # v4.2.0
|
|
|
|
# Tags created with the default GITHUB_TOKEN never fire `on: push: tags`
|
|
# workflows (GitHub suppresses workflows triggered by workflow-created
|
|
# events), so release-artifacts.yml would not run for a release-please
|
|
# tag. workflow_dispatch invoked through the API is exempt from that
|
|
# suppression — dispatch the artifacts build at the new tag explicitly.
|
|
- name: Build and publish release artifacts
|
|
if: ${{ steps.release.outputs.release_created }}
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
gh workflow run release-artifacts.yml \
|
|
--repo "$GITHUB_REPOSITORY" \
|
|
--ref "${{ steps.release.outputs.tag_name }}"
|