chore: switch to OIDC trusted publishing — no NPM_TOKEN needed #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| id-token: write # required for OIDC trusted publishing | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| registry-url: https://registry.npmjs.org | |
| - name: Install dependencies | |
| run: npm install | |
| - name: Build | |
| run: npm run build | |
| - name: Publish if version is new | |
| run: | | |
| PACKAGE_NAME=$(node -e "console.log(require('./package.json').name)") | |
| CURRENT=$(node -e "console.log(require('./package.json').version)") | |
| PUBLISHED=$(npm view "$PACKAGE_NAME" version 2>/dev/null || echo "0.0.0") | |
| if [ "$CURRENT" != "$PUBLISHED" ]; then | |
| echo "Publishing $PACKAGE_NAME@$CURRENT (was $PUBLISHED on npm)" | |
| npm publish --access public --provenance | |
| else | |
| echo "Version $CURRENT already published, skipping" | |
| fi |