|
1 | | -name: Test and Release |
| 1 | +name: CI — test → gate → release |
2 | 2 |
|
3 | 3 | on: |
4 | 4 | push: |
5 | 5 | branches: |
6 | | - - main |
7 | | - - "release/**" |
8 | | - - "prerelease/**" |
| 6 | + - "**" |
| 7 | + tags: |
| 8 | + - "**" |
| 9 | + pull_request: |
| 10 | + types: [opened, synchronize, reopened, ready_for_review] |
9 | 11 |
|
10 | | -concurrency: ${{ github.workflow }}-${{ github.ref }} |
| 12 | +# Ensure only one workflow per ref is active at a time |
| 13 | +concurrency: |
| 14 | + group: ${{ github.workflow }}-${{ github.ref }} |
| 15 | + cancel-in-progress: true |
| 16 | + |
| 17 | +# Default, least-privilege token permissions; jobs elevate as needed |
| 18 | +permissions: |
| 19 | + contents: read |
11 | 20 |
|
12 | 21 | jobs: |
13 | 22 | test: |
14 | | - name: Test (Node ${{ matrix.node }}) |
| 23 | + name: Test (Node ${{ matrix.node-version }}) |
15 | 24 | runs-on: ubuntu-latest |
16 | 25 | strategy: |
17 | 26 | fail-fast: false |
18 | 27 | matrix: |
19 | | - node: [22.x, 24.x] |
| 28 | + node-version: [22.x, 24.x] |
20 | 29 | steps: |
21 | | - - uses: actions/checkout@v4 |
| 30 | + - name: Checkout Repo |
| 31 | + uses: actions/checkout@v4 |
22 | 32 | with: |
23 | 33 | fetch-depth: 0 |
24 | | - - uses: actions/setup-node@v4 |
| 34 | + - name: Install pnpm |
| 35 | + uses: pnpm/action-setup@v4 |
| 36 | + with: |
| 37 | + package_json_file: package.json |
| 38 | + run_install: false |
| 39 | + - name: Setup Node.js ${{ matrix.node-version }} |
| 40 | + uses: actions/setup-node@v4 |
25 | 41 | with: |
26 | | - node-version: ${{ matrix.node }} |
| 42 | + node-version: ${{ matrix.node-version }} |
27 | 43 | cache: pnpm |
28 | 44 | cache-dependency-path: pnpm-lock.yaml |
29 | | - - uses: pnpm/action-setup@v4 |
30 | | - with: |
31 | | - # Use the pnpm version pinned in package.json `packageManager` to avoid conflicts |
32 | | - run_install: false |
33 | | - - run: pnpm install --frozen-lockfile |
34 | | - - run: pnpm -w run fmt:check |
35 | | - - run: pnpm -w run typecheck:tsgo |
| 45 | + - name: Install dependencies |
| 46 | + run: pnpm install --frozen-lockfile |
| 47 | + - name: Format check |
| 48 | + run: pnpm -w run fmt:check |
| 49 | + - name: Typecheck (tsgo) |
| 50 | + run: pnpm -w run typecheck:tsgo |
36 | 51 |
|
37 | 52 | determine_release: |
| 53 | + name: Determine release |
| 54 | + needs: [test] |
38 | 55 | runs-on: ubuntu-latest |
39 | 56 | outputs: |
40 | 57 | is_prerelease: ${{ steps.determine.outputs.is_prerelease }} |
41 | 58 | is_release: ${{ steps.determine.outputs.is_release }} |
42 | 59 | steps: |
43 | | - - uses: actions/checkout@v4 |
| 60 | + - name: Checkout Repo |
| 61 | + uses: actions/checkout@v4 |
44 | 62 | with: |
45 | 63 | fetch-depth: 0 |
46 | | - - uses: actions/setup-node@v4 |
| 64 | + - name: Install pnpm |
| 65 | + uses: pnpm/action-setup@v4 |
| 66 | + with: |
| 67 | + package_json_file: package.json |
| 68 | + run_install: false |
| 69 | + - name: Setup Node.js 24 |
| 70 | + uses: actions/setup-node@v4 |
47 | 71 | with: |
48 | 72 | node-version: 24.x |
49 | 73 | cache: pnpm |
50 | 74 | cache-dependency-path: pnpm-lock.yaml |
51 | | - - uses: pnpm/action-setup@v4 |
52 | | - with: |
53 | | - run_install: false |
54 | | - - run: pnpm install --frozen-lockfile |
55 | | - - id: determine |
| 75 | + - name: Install dependencies |
| 76 | + run: pnpm install --frozen-lockfile |
| 77 | + - name: Compute release flags |
| 78 | + id: determine |
56 | 79 | run: | |
57 | | - pnpm changeset status --output=changeset-status.json |
| 80 | + # Changesets can error on PR merge refs; tolerate and default to no pre mode |
| 81 | + pnpm changeset status --output=changeset-status.json || echo '{}' > changeset-status.json |
58 | 82 | PRE=$(jq -r '.preState.mode // ""' changeset-status.json) |
59 | 83 | rm -f changeset-status.json |
60 | 84 | echo "is_prerelease=$([[ $PRE = 'pre' ]] && echo true || echo false)" >> $GITHUB_OUTPUT |
61 | 85 | echo "is_release=$([[ $GITHUB_REF_NAME = 'main' ]] && echo true || echo false)" >> $GITHUB_OUTPUT |
62 | 86 |
|
63 | 87 | release: |
| 88 | + name: Release |
64 | 89 | needs: [test, determine_release] |
65 | | - if: needs.determine_release.outputs.is_release == 'true' || needs.determine_release.outputs.is_prerelease == 'true' |
| 90 | + if: ${{ github.event_name == 'push' && (needs.determine_release.outputs.is_release == 'true' || needs.determine_release.outputs.is_prerelease == 'true') }} |
66 | 91 | permissions: |
67 | 92 | contents: write |
68 | 93 | runs-on: ubuntu-latest |
69 | 94 | steps: |
70 | | - - uses: actions/checkout@v4 |
| 95 | + - name: Checkout Repo |
| 96 | + uses: actions/checkout@v4 |
71 | 97 | with: |
72 | 98 | fetch-depth: 0 |
73 | | - - run: git config user.name "GitHubActions" && git config user.email "[email protected]" |
74 | | - - uses: actions/setup-node@v4 |
| 99 | + - name: Configure Git author (for tag/commit) |
| 100 | + run: | |
| 101 | + git config user.name "GitHubActions" |
| 102 | + git config user.email "[email protected]" |
| 103 | + - name: Install pnpm |
| 104 | + uses: pnpm/action-setup@v4 |
| 105 | + with: |
| 106 | + package_json_file: package.json |
| 107 | + run_install: false |
| 108 | + - name: Setup Node.js 24 (with npm registry) |
| 109 | + uses: actions/setup-node@v4 |
75 | 110 | with: |
76 | 111 | node-version: 24.x |
77 | 112 | cache: pnpm |
78 | 113 | cache-dependency-path: pnpm-lock.yaml |
79 | 114 | registry-url: https://registry.npmjs.org |
80 | | - - uses: pnpm/action-setup@v4 |
81 | | - with: |
82 | | - run_install: false |
83 | | - - run: pnpm install --frozen-lockfile |
84 | | - - run: pnpm build |
| 115 | + always-auth: true |
| 116 | + env: |
| 117 | + # Ensure the registry is authenticated for publish |
| 118 | + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} |
| 119 | + - name: Install dependencies |
| 120 | + run: pnpm install --frozen-lockfile |
| 121 | + - name: Build |
| 122 | + run: pnpm build |
85 | 123 | - name: Publish with Changesets |
86 | 124 | env: |
| 125 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
87 | 126 | NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} |
88 | 127 | run: | |
89 | 128 | pnpm changeset status |
90 | 129 | pnpm changeset version |
91 | 130 | pnpm changeset publish |
92 | | - git push --follow-tags --no-verify || true |
| 131 | + git push --follow-tags --no-verify |
0 commit comments