chore(release): 0.4.3 #85
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, next] | |
| pull_request: | |
| branches: [main, next] | |
| workflow_dispatch: # manual re-trigger (publish is idempotent) | |
| permissions: | |
| contents: read | |
| id-token: write # <-- required for OIDC/Trusted Publisher (npm provenance) | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Setup Node.js 22 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 22 | |
| - name: Setup Bun latest | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Type check (TypeScript 7) | |
| run: bun run types | |
| - name: Type check (TypeScript 6) | |
| run: bun run types:6 | |
| - name: Lint (eslint) | |
| run: bun run lint | |
| - name: Source tests | |
| run: bun test ./src --coverage --coverage-reporter=text --coverage-reporter=lcov | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v6 | |
| with: | |
| files: ./coverage/lcov.info | |
| slug: 1gr14/error0 | |
| use_oidc: true # tokenless: GitHub OIDC + the Codecov GitHub App (no stored token) | |
| fail_ci_if_error: false # coverage is informational for now — never fail CI on it | |
| - name: Build | |
| run: bun run build | |
| - name: Check published package (publint + are-the-types-wrong) | |
| run: bun run check:package | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: build-files | |
| path: | | |
| dist/ | |
| scripts/ | |
| package.json | |
| retention-days: 1 | |
| smoke: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| node: | |
| - 20 | |
| - 22 | |
| - 24 | |
| steps: | |
| - name: Setup Node.js ${{ matrix.node }} | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ matrix.node }} | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: build-files | |
| path: . | |
| - name: Smoke test built package | |
| run: node scripts/smoke.mjs | |
| # Publish to npm. Idempotent: publishes only if the package's current version isn't on npm yet | |
| # (version bumps happen locally via `bun run release`). dist-tag is derived from the version | |
| # (prerelease x.y.z-next.N → next, stable x.y.z → latest). Auth is npm OIDC Trusted Publisher | |
| # (→ provenance), so no NPM_TOKEN — the workflow filename (ci.yml) must match the trusted-publisher | |
| # config on npm. Both main (latest) and next (prerelease) publish. | |
| publish: | |
| needs: smoke | |
| runs-on: ubuntu-latest | |
| if: > | |
| github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/next') | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| registry-url: https://registry.npmjs.org | |
| scope: '@1gr14' | |
| - name: Upgrade npm (OIDC Trusted Publisher needs npm >= 11.5.1) | |
| run: npm install -g npm@latest | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: build-files | |
| path: . | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| # Channel guard: refuse to publish if the version doesn't match the branch | |
| # (next ↔ -next prerelease, main ↔ stable). publish.ts re-asserts this too. | |
| - name: Channel guard | |
| run: bun run check:channel | |
| - name: Publish package | |
| run: bun run publish:packages |