fix: remove registry-url from setup-node to unblock OIDC trusted publ… #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| id-token: write # required for OIDC trusted publishing | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| # No registry-url here — setup-node's auth token wiring conflicts | |
| # with OIDC trusted publishing. npm detects the GitHub OIDC environment | |
| # automatically when NODE_AUTH_TOKEN is absent. | |
| - name: Install dependencies | |
| run: npm install | |
| - name: Build | |
| run: npm run build | |
| - name: Publish if version is new | |
| run: | | |
| PACKAGE_NAME=$(node -e "console.log(require('./package.json').name)") | |
| CURRENT=$(node -e "console.log(require('./package.json').version)") | |
| PUBLISHED=$(npm view "$PACKAGE_NAME" version 2>/dev/null || echo "0.0.0") | |
| if [ "$CURRENT" != "$PUBLISHED" ]; then | |
| echo "Publishing $PACKAGE_NAME@$CURRENT (was $PUBLISHED on npm)" | |
| npm publish --access public --provenance | |
| else | |
| echo "Version $CURRENT already published, skipping" | |
| fi | |
| env: | |
| NPM_CONFIG_REGISTRY: https://registry.npmjs.org/ |