[Swift] 4.0.0-alpha.2 #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Web — Publish to npm | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Override dist-tag (latest, next, beta, etc.). Leave blank to auto-infer ('next' for prereleases, 'latest' for stable versions)." | |
| required: false | |
| type: string | |
| dry-run: | |
| description: "Run the full pipeline + pack but skip the actual publish. Defaults to true for manual safety; uncheck to actually publish." | |
| required: false | |
| type: boolean | |
| default: true | |
| permissions: | |
| contents: read | |
| id-token: write | |
| concurrency: | |
| group: web-publish | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| name: Publish @shopify/checkout-kit to npm | |
| # Only run when either: | |
| # - A GitHub Release tagged `web/X.Y.Z` is published (auto trigger), OR | |
| # - The workflow is manually dispatched from the `main` branch. The | |
| # branch lock prevents fat-fingering a publish from a feature branch | |
| # that hasn't been reviewed. | |
| # Web tags are `web/X.Y.Z` to disambiguate from Swift's bare semver and | |
| # Android's `android/X.Y.Z`. | |
| if: | | |
| (github.event_name == 'release' && startsWith(github.event.release.tag_name, 'web/')) | |
| || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') | |
| environment: | |
| name: npm-web | |
| url: https://www.npmjs.com/package/@shopify/checkout-kit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| defaults: | |
| run: | |
| working-directory: platforms/web | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| # `ignore-scripts` prevents dep postinstall scripts from running in this | |
| # privileged job — primary mitigation against credential exfiltration | |
| # from a compromised transitive dependency. | |
| - name: Setup Node.js, pnpm, and install dependencies | |
| uses: ./.github/actions/setup | |
| with: | |
| node-version-file: platforms/web/package.json | |
| cache-dependency-path: platforms/web/pnpm-lock.yaml | |
| package-json-file: platforms/web/package.json | |
| working-directory: platforms/web | |
| ignore-scripts: "true" | |
| - name: Validate tag matches package.json version | |
| if: github.event_name == 'release' | |
| env: | |
| TAG_NAME: ${{ github.event.release.tag_name }} | |
| run: | | |
| set -euo pipefail | |
| VERSION_FROM_TAG="${TAG_NAME#web/}" | |
| VERSION_FROM_PKG=$(node -p "require('./package.json').version") | |
| if [ "$VERSION_FROM_TAG" != "$VERSION_FROM_PKG" ]; then | |
| echo "::error::Tag '$TAG_NAME' implies version '$VERSION_FROM_TAG', but package.json has '$VERSION_FROM_PKG'." | |
| echo "::error::Bump the version in a PR before tagging the release." | |
| exit 1 | |
| fi | |
| echo "✓ Tag '$TAG_NAME' matches package.json version '$VERSION_FROM_PKG'." | |
| - name: Verify version is not already published | |
| run: | | |
| set -euo pipefail | |
| NAME=$(node -p "require('./package.json').name") | |
| VERSION=$(node -p "require('./package.json').version") | |
| URL="https://registry.npmjs.org/${NAME}/${VERSION}" | |
| if curl -fs "$URL" > /dev/null; then | |
| echo "::error::${NAME}@${VERSION} is already published on npm. Bump platforms/web/package.json before re-running." | |
| exit 1 | |
| fi | |
| echo "::notice::${NAME}@${VERSION} is not yet on npm — safe to proceed." | |
| - name: Lint (typecheck + oxlint + format) | |
| run: pnpm lint | |
| - name: Test | |
| run: pnpm test | |
| - name: Build | |
| run: pnpm build | |
| - name: Verify package (publint) | |
| run: pnpm verify | |
| - name: Pack and inspect contents | |
| run: | | |
| pnpm pack --pack-destination /tmp/web-publish | |
| echo "Tarball contents:" | |
| tar -tzf /tmp/web-publish/*.tgz | sort | |
| - name: Compute dist-tag | |
| id: tag | |
| env: | |
| OVERRIDE: ${{ inputs.tag }} | |
| PRERELEASE: ${{ github.event.release.prerelease }} | |
| run: | | |
| set -euo pipefail | |
| VERSION=$(node -p "require('./package.json').version") | |
| if [ -n "${OVERRIDE:-}" ]; then | |
| TAG="$OVERRIDE" | |
| echo "Using workflow_dispatch override dist-tag: $TAG" | |
| elif [ "${PRERELEASE:-}" = "true" ]; then | |
| TAG="next" | |
| echo "GitHub Release marked as pre-release — publishing version '$VERSION' under 'next'." | |
| elif node -e "process.exit(require('./package.json').version.includes('-') ? 0 : 1)"; then | |
| TAG="next" | |
| echo "Version '$VERSION' is a semver prerelease (contains '-') — publishing under 'next'." | |
| echo " (Use the 'tag' workflow_dispatch input to override if you really want this on 'latest'.)" | |
| else | |
| TAG="latest" | |
| echo "Stable version '$VERSION' — publishing under 'latest'." | |
| fi | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| # `DIST_TAG` is passed via `env:` (not direct ${{ }} interpolation) so | |
| # that a workflow_dispatch input like `latest$(whoami)` is treated as a | |
| # literal string by bash rather than command substitution. | |
| - name: Publish to npm | |
| if: ${{ !inputs.dry-run }} | |
| run: pnpm publish --no-git-checks --tag "$DIST_TAG" --access public --provenance | |
| env: | |
| DIST_TAG: ${{ steps.tag.outputs.tag }} | |
| NPM_CONFIG_PROVENANCE: "true" | |
| NPM_TOKEN: "" | |
| NODE_AUTH_TOKEN: "" | |
| - name: Dry-run summary | |
| if: ${{ inputs.dry-run }} | |
| env: | |
| DIST_TAG: ${{ steps.tag.outputs.tag }} | |
| run: | | |
| echo "::notice::Dry-run requested — skipped npm publish." | |
| echo "Would have published with: --tag $DIST_TAG --access public --provenance" |