Publish to npm #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to npm | |
| # Publishing a GitHub Release is the trigger — pushing a tag alone is not | |
| # enough, so a mistagged commit can still be corrected before anything | |
| # reaches the registry. npm publishes are effectively permanent. | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| # Required for npm provenance: the published package carries a signed, | |
| # verifiable link back to the commit and workflow that built it. | |
| id-token: write | |
| jobs: | |
| publish: | |
| if: github.repository == 'deckflow/html-editor' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out the release | |
| uses: actions/checkout@v6 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '24' | |
| registry-url: 'https://registry.npmjs.org' | |
| package-manager-cache: false | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Verify release tag | |
| env: | |
| RELEASE_TAG: ${{ github.event.release.tag_name }} | |
| run: >- | |
| node --input-type=module -e ' | |
| import { readFileSync } from "node:fs"; | |
| const { version } = JSON.parse(readFileSync("package.json", "utf8")); | |
| const tag = process.env.RELEASE_TAG; | |
| if (tag && tag !== version && tag !== `v${version}`) { | |
| throw new Error(`Release tag ${tag} does not match package version ${version}`); | |
| } | |
| console.log(`Publishing @deckflow/html-editor@${version}`); | |
| ' | |
| - name: Test package | |
| run: npm test | |
| - name: Inspect package contents | |
| run: npm pack --dry-run | |
| - name: Publish package | |
| run: npm publish | |
| env: | |
| # An npm automation token with publish rights on the @deckflow scope. | |
| # The built-in GITHUB_TOKEN cannot publish here — it only ever | |
| # authenticated against GitHub Packages. | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} |