ui/.github/workflows/publish.yml at main · nextidemedia/ui · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
name: Publish @nextide/ui
run-name: Publish @nextide/ui ${{ inputs.tag }}

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Existing release tag, for example v1.0.0
        required: true
        type: string

permissions:
  contents: read
  id-token: write

concurrency:
  group: publish-${{ inputs.tag }}
  cancel-in-progress: false

jobs:
  safety:
    name: Deploy safety
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      sha: ${{ steps.tag.outputs.sha }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ inputs.tag }}
      - name: Verify release tag
        id: tag
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          package_version="$(node -p "require('./packages/ui/package.json').version")"
          test "$RELEASE_TAG" = "v$package_version"
          git show-ref --verify --quiet "refs/tags/$RELEASE_TAG"
          test "$(git rev-parse HEAD)" = "$(git rev-list -n 1 "$RELEASE_TAG")"
          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

  qualification:
    needs: safety
    uses: ./.github/workflows/ci.yml
    with:
      profile: deploy
      source_sha: ${{ needs.safety.outputs.sha }}

  publish:
    name: Apply release
    needs: [safety, qualification]
    if: ${{ !cancelled() && needs.safety.result == 'success' && needs.qualification.result == 'success' }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Check out release tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ needs.safety.outputs.sha }}

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24.18.0"
          registry-url: https://registry.npmjs.org
          package-manager-cache: false

      - name: Install pnpm
        run: npm install --global pnpm@12.6.0

      - name: Verify release tag
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        shell: bash
        run: |
          package_version="$(node -p "require('./packages/ui/package.json').version")"
          test "$RELEASE_TAG" = "v$package_version"
          git show-ref --verify --quiet "refs/tags/$RELEASE_TAG"
          test "$(git rev-parse HEAD)" = "$(git rev-list -n 1 "$RELEASE_TAG")"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Check package contents
        working-directory: packages/ui
        run: npm pack --dry-run --access public

      - name: Publish
        working-directory: packages/ui
        run: npm publish --access public