fix: use --provenance flag instead of npm self-update for Trusted Pub… #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: write | |
| jobs: | |
| build-artifacts: | |
| name: build ${{ matrix.target }} | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: aarch64-apple-darwin | |
| runner: macos-14 | |
| - target: x86_64-apple-darwin | |
| runner: macos-14 | |
| - target: x86_64-unknown-linux-gnu | |
| runner: ubuntu-latest | |
| - target: aarch64-unknown-linux-gnu | |
| runner: ubuntu-latest | |
| - target: x86_64-pc-windows-msvc | |
| runner: windows-latest | |
| - target: aarch64-pc-windows-msvc | |
| runner: windows-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup build environment | |
| uses: ./.github/actions/setup-build-env | |
| with: | |
| rust-targets: ${{ matrix.target }} | |
| - name: Install Linux ARM64 cross-compilation linker | |
| if: matrix.target == 'aarch64-unknown-linux-gnu' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y gcc-aarch64-linux-gnu | |
| mkdir -p .cargo | |
| printf '[target.aarch64-unknown-linux-gnu]\nlinker = "aarch64-linux-gnu-gcc"\n' > .cargo/config.toml | |
| - name: Verify release config | |
| run: npm run release:verify-config | |
| - name: Build artifact | |
| run: npm run release:build-artifact -- ${{ matrix.target }} | |
| - name: Upload artifact bundle | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: release-artifacts-${{ matrix.target }} | |
| path: .work/release/artifacts/ | |
| github-release: | |
| name: publish GitHub Release | |
| runs-on: ubuntu-latest | |
| needs: | |
| - build-artifacts | |
| outputs: | |
| version: ${{ steps.get-version.outputs.version }} | |
| published: ${{ steps.get-version.outputs.published }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup build environment | |
| uses: ./.github/actions/setup-build-env | |
| - name: Download all release artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: .work/release/artifacts | |
| pattern: release-artifacts-* | |
| merge-multiple: true | |
| - name: Run release quality gates | |
| run: npm run release:quality-gates | |
| - name: Publish repo-native release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: npm run release:ci | |
| - name: Get release version | |
| id: get-version | |
| run: | | |
| TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "") | |
| if [ -n "$TAG" ]; then | |
| VERSION="${TAG#v}" | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "published=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "version=" >> $GITHUB_OUTPUT | |
| echo "published=false" >> $GITHUB_OUTPUT | |
| fi | |
| npm-publish: | |
| name: publish to npm | |
| runs-on: ubuntu-latest | |
| needs: | |
| - github-release | |
| if: needs.github-release.outputs.published == 'true' | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| registry-url: https://registry.npmjs.org | |
| - name: Download all release artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: .work/release/artifacts | |
| pattern: release-artifacts-* | |
| merge-multiple: true | |
| - name: Assemble and publish npm packages | |
| env: | |
| VERSION: ${{ needs.github-release.outputs.version }} | |
| run: node scripts/release/publish-npm-packages.mjs |