Chris Farhood
719c8b7030
The previous workflow ran npm publish on every push to master and gated it via npm view on a stale scoped package name, which made the check always think the version was unpublished and 403'd whenever the registry already had it. Switch the publish job to fire only on push of a v* tag, verify the tag matches package.json, and use the standard NODE_AUTH_TOKEN flow via setup-node's registry-url. Tests still run on master push and PRs. Release flow: bump version, commit, push master, then git tag v<version> && git push origin v<version>. Co-Authored-By: Paperclip <noreply@paperclip.ing>
49 lines
1.2 KiB
YAML
49 lines
1.2 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
tags: ["v*"]
|
|
pull_request:
|
|
branches: [master]
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
- run: npm ci
|
|
- run: npm run typecheck
|
|
- run: npm test
|
|
|
|
publish:
|
|
needs: test
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
|
|
permissions:
|
|
id-token: write
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
registry-url: "https://registry.npmjs.org"
|
|
- name: Verify tag matches package.json version
|
|
run: |
|
|
TAG_VERSION="${GITHUB_REF#refs/tags/v}"
|
|
PKG_VERSION=$(node -p "require('./package.json').version")
|
|
if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
|
|
echo "Tag v$TAG_VERSION does not match package.json version $PKG_VERSION"
|
|
exit 1
|
|
fi
|
|
- run: npm ci
|
|
- run: npm run build
|
|
- run: npm publish --access public
|
|
env:
|
|
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|