feat(tables): add tree support #1677
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| on: | |
| pull_request: | |
| paths-ignore: | |
| - '.changeset/**' | |
| - '.husky/**' | |
| push: | |
| branches: | |
| - main | |
| concurrency: | |
| group: publish-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| id-token: write # Required for trusted publishing (OIDC) | |
| jobs: | |
| publish-canary: | |
| name: 'Build & canary release' | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| env: | |
| NODE_OPTIONS: --max-old-space-size=4096 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Installs the pnpm pinned by `packageManager` — the same field pnpm reads | |
| # to switch itself locally, so CI and a contributor cannot drift apart. | |
| # Must precede `setup-node`, whose `cache: 'pnpm'` needs `pnpm` on PATH. | |
| - uses: pnpm/action-setup@v6 | |
| # No Node pin of its own any more: `.nvmrc` is Node 24, which ships | |
| # npm 11.x, and OIDC trusted publishing needs npm ≥ 11.5.1. (Node 22 | |
| # shipped npm 10.x, which is why this job used to pin a version.) | |
| # Do not run `npm install -g npm@latest` — it corrupts npm's module | |
| # tree (e.g. missing sigstore) on hosted runners. | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: '.nvmrc' | |
| registry-url: 'https://registry.npmjs.org' | |
| cache: 'pnpm' | |
| - name: Verify npm version and OIDC availability | |
| run: | | |
| echo "node version: $(node --version)" | |
| echo "npm version: $(npm --version)" | |
| echo "OIDC available: ${{ env.ACTIONS_ID_TOKEN_REQUEST_URL != '' }}" | |
| - name: Install dependencies | |
| run: pnpm install | |
| - name: Set version info | |
| id: version | |
| run: | | |
| SHORT_SHA=$(git rev-parse --short "$GITHUB_SHA") | |
| VERSION="0.0.0-canary-$SHORT_SHA" | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT | |
| - name: Set canary version | |
| run: npm version ${{ steps.version.outputs.version }} --no-git-tag-version | |
| - name: Build project | |
| run: pnpm build | |
| - name: Clear .npmrc auth token (use OIDC instead) | |
| run: npm config delete //registry.npmjs.org/:_authToken || true | |
| # The Version Packages PR changes nothing but the version and changelog, | |
| # so a canary of it would be a duplicate of what `main` already published | |
| # and would leave another stale `pr_*` dist-tag behind. The job itself | |
| # still runs so the required `Build & canary release` check reports, and | |
| # the build above still verifies the exact tree that is about to ship. | |
| - name: Publish canary to npm | |
| if: github.head_ref != 'changeset-release/main' | |
| env: | |
| CANARY_VERSION: ${{ steps.version.outputs.version }} | |
| PR_TAG: pr_${{ github.event.number }} | |
| run: | | |
| published() { npm view "@cube-dev/ui-kit@$CANARY_VERSION" version >/dev/null 2>&1; } | |
| retag() { npm dist-tag add "@cube-dev/ui-kit@$CANARY_VERSION" "$PR_TAG" || true; } | |
| # Registry reads lag writes by a few seconds, so a single negative | |
| # read right after a publish is not proof that it failed to land. | |
| landed() { for _ in 1 2 3; do published && return 0; sleep 5; done; return 1; } | |
| if published; then | |
| echo "Canary version $CANARY_VERSION is already published; re-tagging '$PR_TAG' and skipping publish." | |
| retag | |
| exit 0 | |
| fi | |
| if npm publish --access public --tag "$PR_TAG" --provenance; then | |
| exit 0 | |
| fi | |
| # `--provenance` signs the tarball and writes an entry to the Sigstore | |
| # transparency log. When that request stalls, npm's own client retries | |
| # it and resubmits a byte-identical envelope, which Rekor rejects: | |
| # | |
| # TLOG_CREATE_ENTRY_ERROR (409) an equivalent entry already exists | |
| # | |
| # Nothing is actually wrong — a fresh run mints a new ephemeral | |
| # signing certificate, so the envelope differs and Rekor accepts it. | |
| # One retry beats red-ticking a PR over a transient signing failure. | |
| # | |
| # But check whether the publish landed before retrying: the registry | |
| # can accept a publish and still report an error, and versions are | |
| # immutable, so a second publish would fail on "cannot publish over" | |
| # and turn a soft failure into a hard one. | |
| if landed; then | |
| echo "::warning::Publish reported an error but $CANARY_VERSION is on the registry; tagging '$PR_TAG' only." | |
| retag | |
| exit 0 | |
| fi | |
| echo "::warning::Publish failed without landing $CANARY_VERSION; retrying once with a fresh signing certificate." | |
| if npm publish --access public --tag "$PR_TAG" --provenance; then | |
| exit 0 | |
| fi | |
| # The retry itself can fail with "cannot publish over the previously | |
| # published versions" if the first attempt landed after the loop above | |
| # gave up waiting. That means the canary IS on the registry, which is | |
| # the outcome this step exists to produce — tag it and pass. | |
| if landed; then | |
| echo "::warning::Retry rejected as a duplicate; $CANARY_VERSION was already on the registry. Tagging '$PR_TAG'." | |
| retag | |
| exit 0 | |
| fi | |
| exit 1 | |
| # The canary is already on npm by this point — `Publish canary to npm` | |
| # above owns that outcome. Failing the job because we could not post a | |
| # comment about it reports a successful release as broken. | |
| - name: Comment PR | |
| if: github.head_ref != 'changeset-release/main' | |
| continue-on-error: true | |
| uses: actions/github-script@v6 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| script: | | |
| const setMessage = require('${{ github.workspace }}/scripts/ci/set-message.cjs') | |
| await setMessage({ | |
| header: "## :package: NPM canary release", | |
| body: 'Deployed canary version [${{ steps.version.outputs.version }}](https://www.npmjs.com/package/@cube-dev/ui-kit/v/${{ steps.version.outputs.version }}).', | |
| github, | |
| repo: context.repo, | |
| prNumber: ${{ github.event.number }} | |
| }) | |
| publish-release: | |
| name: 'Publish release' | |
| if: github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| env: | |
| NODE_OPTIONS: --max-old-space-size=4096 | |
| outputs: | |
| published: ${{ steps.changesets.outputs.published }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Installs the pnpm pinned by `packageManager` — the same field pnpm reads | |
| # to switch itself locally, so CI and a contributor cannot drift apart. | |
| # Must precede `setup-node`, whose `cache: 'pnpm'` needs `pnpm` on PATH. | |
| - uses: pnpm/action-setup@v6 | |
| # No Node pin of its own any more: `.nvmrc` is Node 24, which ships | |
| # npm 11.x, and OIDC trusted publishing needs npm ≥ 11.5.1. (Node 22 | |
| # shipped npm 10.x, which is why this job used to pin a version.) | |
| # Do not run `npm install -g npm@latest` — it corrupts npm's module | |
| # tree (e.g. missing sigstore) on hosted runners. | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: '.nvmrc' | |
| registry-url: 'https://registry.npmjs.org' | |
| cache: 'pnpm' | |
| - name: Verify npm version and OIDC availability | |
| run: | | |
| echo "node version: $(node --version)" | |
| echo "npm version: $(npm --version)" | |
| echo "OIDC available: ${{ env.ACTIONS_ID_TOKEN_REQUEST_URL != '' }}" | |
| - name: Install Dependencies | |
| run: pnpm install | |
| - name: Clear .npmrc auth token (use OIDC instead) | |
| run: npm config delete //registry.npmjs.org/:_authToken || true | |
| - name: Create Release Pull Request or Publish to npm | |
| id: changesets | |
| uses: changesets/action@v1 | |
| with: | |
| publish: pnpm release | |
| commit: 'chore: release' | |
| env: | |
| # Must be a PAT, not the default GITHUB_TOKEN. GitHub deliberately | |
| # does not fire `pull_request` events for PRs opened with | |
| # GITHUB_TOKEN, so the Version Packages PR never received the checks | |
| # `main` requires (Build & canary release, Tests & lint, UI Tests, | |
| # UI Review) and could only ever be merged with an admin override. | |
| GITHUB_TOKEN: ${{ secrets.UIKIT_GITHUB_TOKEN }} | |
| # NPM_TOKEN not needed - using trusted publishing (OIDC) | |
| deploy-chromatic-release: | |
| name: 'Deploy storybook to Chromatic' | |
| needs: publish-release | |
| if: github.event_name == 'push' && needs.publish-release.outputs.published == 'true' | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: Chromatic Production | |
| url: ${{ steps.publish_chromatic.outputs.url }} | |
| env: | |
| NODE_OPTIONS: --max-old-space-size=4096 | |
| CHROMATIC_RETRIES: 5 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/cache@v6 | |
| name: Download storybook cache | |
| with: | |
| path: | | |
| **/node_modules/.cache | |
| key: ${{ runner.os }}-storybook-${{ github.run_id }} | |
| restore-keys: | | |
| ${{ runner.os }}-storybook | |
| # Installs the pnpm pinned by `packageManager` — the same field pnpm reads | |
| # to switch itself locally, so CI and a contributor cannot drift apart. | |
| # Must precede `setup-node`, whose `cache: 'pnpm'` needs `pnpm` on PATH. | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: '.nvmrc' | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install | |
| - name: Publish to Chromatic | |
| id: publish_chromatic | |
| uses: chromaui/action@v11 | |
| with: | |
| exitZeroOnChanges: true | |
| exitOnceUploaded: true | |
| autoAcceptChanges: true | |
| onlyChanged: true | |
| projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }} |