0.4.0 #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to npm | |
| # Trusted publishing (OIDC): releases carry NO stored credential. npm verifies | |
| # this workflow's identity against the trusted publisher configured for | |
| # `swisscode` on npmjs.com, so there is deliberately no NPM_TOKEN secret in the | |
| # repo. See docs/RELEASING.md for the one-time npmjs.com setup. | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| # id-token: write is what lets npm mint the OIDC assertion and attach a build | |
| # provenance attestation. contents: read is all the checkout needs. | |
| permissions: | |
| contents: read | |
| id-token: write | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # SHA-pinned (not floating tags): this job holds id-token: write, so a | |
| # moved action tag could execute where the OIDC token is mintable and | |
| # provenance signs the tree. Dependabot bumps these via reviewable PRs. | |
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | |
| - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 | |
| with: | |
| node-version: 24 | |
| registry-url: 'https://registry.npmjs.org' | |
| # Trusted publishing needs npm >= 11.5.1; the runner's bundled npm can lag. | |
| # Pinned exactly rather than @latest for the same supply-chain reason. | |
| - name: Use a trusted-publishing-capable npm | |
| run: npm install -g npm@11.5.1 | |
| - name: Install dependencies | |
| run: npm ci | |
| # The publish gate. `npm test` runs tsc --noEmit, the build, and the full | |
| # node --test suite; a red tree never reaches the registry. | |
| - name: Test | |
| run: npm test | |
| # A mistagged release must never ship the wrong version. The tag drives the | |
| # release, so it has to agree with what package.json will actually publish. | |
| - name: Verify the tag matches package.json | |
| run: | | |
| pkg="$(node -p "require('./package.json').version")" | |
| tag="${GITHUB_REF_NAME#v}" | |
| if [ "$pkg" != "$tag" ]; then | |
| echo "::error::tag v$tag does not match package.json version $pkg" | |
| exit 1 | |
| fi | |
| # No NODE_AUTH_TOKEN: trusted publishing authenticates via OIDC, and | |
| # --provenance attaches the signed build attestation. | |
| - name: Publish with provenance | |
| run: npm publish --provenance --access public |