v0.2.0 #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to npm | |
| # Triggered by publishing a GitHub Release. Builds, verifies, then publishes | |
| # engramgraph to npm via OIDC Trusted Publishing — NO token needed. | |
| # | |
| # Setup (one-time, on npmjs.com → engramgraph → Settings → Trusted | |
| # Publisher): add a GitHub Actions trusted publisher with | |
| # organization/user: AsiaOstrich repository: EngramGraph workflow: publish.yml | |
| # npm then mints short-lived credentials from this job's OIDC id-token; the repo | |
| # must be public. Provenance is generated automatically. | |
| on: | |
| release: | |
| types: [published] | |
| jobs: | |
| publish: | |
| name: Publish to npm | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write # OIDC trusted publishing + provenance | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # NOTE: no `registry-url` — it makes setup-node write an empty | |
| # //registry.npmjs.org/:_authToken to .npmrc, which suppresses OIDC | |
| # trusted publishing (npm takes the empty-token path → anonymous → E404). | |
| # Without it, npm uses the default registry and engages OIDC. | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| # OIDC trusted publishing requires npm >= 11.5.1 (newer than the bundled npm). | |
| - run: npm install -g npm@latest | |
| - run: npm --version | |
| - run: npm install --legacy-peer-deps | |
| # Build + verify before publishing (native: kuzu + tree-sitter compile here). | |
| - run: npm run build | |
| - run: npm run typecheck | |
| - run: npm test | |
| - name: Determine npm dist-tag | |
| id: tag | |
| run: | | |
| VERSION=$(node -p "require('./package.json').version") | |
| if echo "$VERSION" | grep -qE '\-(beta|alpha|rc)\.'; then | |
| echo "tag=next" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "tag=latest" >> "$GITHUB_OUTPUT" | |
| fi | |
| # No NODE_AUTH_TOKEN: npm authenticates via the OIDC id-token against the | |
| # trusted publisher configured on npmjs. Provenance is automatic. | |
| - name: Publish engramgraph (OIDC trusted publishing) | |
| run: npm publish --access public --tag ${{ steps.tag.outputs.tag }} |