mirror of
https://github.com/only-cli/oc.git
synced 2026-09-15 10:40:56 +02:00
only-cli
c758ab2298
npm ci in CI requires package-lock.json, so stop ignoring it; it pins CI and contributor installs only, consumers never see it. publish.yml now maps release channels to npm dist-tags: latest, beta, alpha (from the version suffix of a GitHub release) and dev (manual runs stamp a unique 0.x.y-dev.N version per build). Publishing a prerelease version to latest fails loud.
69 lines
2.5 KiB
YAML
69 lines
2.5 KiB
YAML
# Publishes to npm via OIDC trusted publishing: no token, no OTP prompt.
|
|
# One-time setup on npmjs.com after the package exists: package settings,
|
|
# Trusted Publisher, GitHub Actions, repository only-cli/only-cli, workflow
|
|
# file publish.yml. From then on, publishing a GitHub release ships to npm.
|
|
#
|
|
# Release channels map to npm dist-tags:
|
|
# latest stable releases, what `npm install only-cli` gets
|
|
# beta release candidates, version like 0.2.0-beta.1
|
|
# alpha earlier previews, version like 0.2.0-alpha.1
|
|
# dev throwaway builds from main, version stamped per run
|
|
#
|
|
# A GitHub release picks its channel from the version suffix, so marking a
|
|
# release 0.2.0-beta.1 ships to beta automatically. Run the workflow by hand
|
|
# (Actions tab, publish, Run workflow) to cut a dev build without a release.
|
|
name: publish
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
workflow_dispatch:
|
|
inputs:
|
|
channel:
|
|
description: npm dist-tag to publish under
|
|
type: choice
|
|
options: [dev, alpha, beta, latest]
|
|
default: dev
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 24
|
|
registry-url: https://registry.npmjs.org
|
|
# Trusted publishing needs npm 11.5.1 or newer.
|
|
- run: npm install -g npm@latest
|
|
- run: npm ci
|
|
- run: npm test
|
|
- name: pick channel and version
|
|
run: |
|
|
V=$(node -p "require('./package.json').version")
|
|
CHANNEL="${{ github.event_name == 'workflow_dispatch' && inputs.channel || '' }}"
|
|
if [ -z "$CHANNEL" ]; then
|
|
case "$V" in
|
|
*-alpha*) CHANNEL=alpha ;;
|
|
*-beta*) CHANNEL=beta ;;
|
|
*-dev*) CHANNEL=dev ;;
|
|
*) CHANNEL=latest ;;
|
|
esac
|
|
fi
|
|
# Fail loud instead of shipping a prerelease as stable.
|
|
if [ "$CHANNEL" = latest ] && [ "${V#*-}" != "$V" ]; then
|
|
echo "refusing to publish prerelease version $V to latest" >&2
|
|
exit 1
|
|
fi
|
|
# Dev builds get a unique version per run so repeat publishes never
|
|
# collide; the version in git stays untouched.
|
|
if [ "$CHANNEL" = dev ] && [ "${V%-dev*}" = "$V" ]; then
|
|
npm version --no-git-tag-version "${V%%-*}-dev.${{ github.run_number }}"
|
|
fi
|
|
echo "CHANNEL=$CHANNEL" >> "$GITHUB_ENV"
|
|
- run: npm publish --access public --tag "$CHANNEL"
|