npm Release #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Publishes @nativescript/font-manager to npm from an existing SPM release tag, | |
| # so the packaged nativescript.config.ts always points at a resolvable | |
| # FontManager.xcframework release. | |
| # | |
| # Triggered automatically at the end of the SPM Release workflow, or manually | |
| # via workflow_dispatch. | |
| # | |
| # Authentication uses npm Trusted Publishing (OIDC) — no NPM_TOKEN required. | |
| # This mirrors the proven publish flow in the @nativescript/ios repo: | |
| # * the job runs in the `npm-publish` environment, which MUST match the | |
| # environment configured on the npm Trusted Publisher for this package | |
| # (repo NativeScript/font-manager + workflow npm_release.yml + env | |
| # npm-publish). Without the matching environment the OIDC token exchange is | |
| # rejected and publish falls back to (missing) token auth -> 404/ENEEDAUTH. | |
| # * npm is upgraded to 11.5.1 via corepack (Trusted Publishing needs >=11.5.1; | |
| # `npm i -g npm@latest` corrupts the global install and drops bundled deps | |
| # like sigstore — npm/cli#9722). | |
| # * the .npmrc that setup-node writes is removed and NODE_AUTH_TOKEN cleared | |
| # before publish so the empty token can't shadow the OIDC exchange. | |
| name: npm Release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Version to publish (e.g. 1.0.12). Must match an existing SPM release tag. Defaults to packages/font-manager/package.json.' | |
| required: false | |
| type: string | |
| concurrency: | |
| group: npm-release | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| environment: npm-publish # must match the npm Trusted Publisher environment | |
| permissions: | |
| contents: read | |
| id-token: write # required for npm Trusted Publishing (OIDC) + provenance | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Resolve version | |
| id: version | |
| run: | | |
| VERSION="${{ github.event.inputs.version }}" | |
| if [ -z "$VERSION" ]; then | |
| VERSION="$(node -p "require('./packages/font-manager/package.json').version")" | |
| fi | |
| if ! git rev-parse -q --verify "refs/tags/$VERSION^{commit}" > /dev/null; then | |
| echo "error: tag $VERSION not found — run the SPM Release workflow first" >&2 | |
| exit 1 | |
| fi | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Checkout release tag | |
| run: git checkout "refs/tags/${{ steps.version.outputs.version }}" | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Update npm (required for OIDC trusted publishing) | |
| run: | | |
| corepack enable npm | |
| corepack install -g npm@11.5.1 | |
| test "$(npm --version)" = "11.5.1" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Verify package.json matches release version | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| PKG_VERSION="$(node -p "require('./packages/font-manager/package.json').version")" | |
| if [ "$PKG_VERSION" != "$VERSION" ]; then | |
| echo "error: packages/font-manager/package.json is $PKG_VERSION but expected $VERSION" >&2 | |
| exit 1 | |
| fi | |
| # build.all runs tools/scripts/build-finish.ts, which produces a | |
| # ready-to-publish dist/packages/font-manager (cleaned package.json, | |
| # publishing assets copied in). | |
| - name: Build @nativescript/font-manager | |
| run: npx nx run font-manager:build.all | |
| # Publish the exact version from the release tag via OIDC. No token is | |
| # used — the setup-node .npmrc and NODE_AUTH_TOKEN are cleared so npm | |
| # performs the Trusted Publishing token exchange and generates provenance. | |
| - name: Publish @nativescript/font-manager (OIDC trusted publishing) | |
| working-directory: dist/packages/font-manager | |
| env: | |
| NODE_AUTH_TOKEN: '' | |
| run: | | |
| unset NODE_AUTH_TOKEN | |
| if [ -n "${NPM_CONFIG_USERCONFIG:-}" ]; then | |
| rm -f "$NPM_CONFIG_USERCONFIG" | |
| fi | |
| npm publish --access public --provenance | |
| - name: Verify npm publish | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| for i in $(seq 1 10); do | |
| if [ "$(npm view "@nativescript/font-manager@$VERSION" version 2>/dev/null)" = "$VERSION" ]; then | |
| echo "@nativescript/font-manager@$VERSION is live" | |
| exit 0 | |
| fi | |
| echo "not visible yet, retrying ($i/10)..." | |
| sleep 15 | |
| done | |
| echo "error: @nativescript/font-manager@$VERSION not visible on the registry" >&2 | |
| exit 1 |