chore(deps-dev): Bump typescript from 6.0.3 to 7.0.2 (#139) #134
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| concurrency: release | |
| jobs: | |
| release: | |
| name: release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # pnpm version is read from package.json#packageManager — do not also | |
| # pass `version:` here, pnpm/action-setup errors on double-specification. | |
| - uses: pnpm/action-setup@v6 | |
| # Node 24 ships with npm 11.x. OIDC Trusted Publishing requires | |
| # npm >= 11.5.1; on Node 22 (npm 10.x) `npm i -g npm@latest` half- | |
| # upgrades and crashes with "Cannot find module 'promise-retry'", | |
| # so we just use a Node that already has the right npm. | |
| - uses: actions/setup-node@v6.4.0 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| registry-url: "https://registry.npmjs.org" | |
| - run: pnpm install --frozen-lockfile | |
| # Build must run BEFORE typecheck/test: downstream workspace packages | |
| # import from @released/core, whose .d.ts is only generated by the build. | |
| - name: Build core + CLI | |
| run: pnpm -r build | |
| - name: Test + typecheck | |
| run: | | |
| pnpm -r typecheck | |
| pnpm -r test | |
| # Fail fast BEFORE anything is published or deployed. Neither Worker has a | |
| # build script, so nothing above parses their wrangler.toml — a config that | |
| # cannot bundle, or a Dockerfile that cannot build, would otherwise first | |
| # fail inside `Deploy web` below, leaving a half-release (CLI already on | |
| # npm, or web deployed and web-og not). | |
| # | |
| # This must live HERE, not only in ci.yml: a push to main starts both | |
| # workflows concurrently and main has no required status checks, so a red CI | |
| # job cannot hold back this deploy. ci.yml runs the same script for PR-time | |
| # signal; this call is the one that gates production. | |
| # | |
| # Local config only — it cannot catch a [[migrations]] tag conflicting with | |
| # what is already applied to released-web, or a missing secret. | |
| - name: Validate deploy config (dry run) | |
| run: pnpm check:deploy-config | |
| # Changesets: opens / updates a "Version Packages" PR when changesets are | |
| # pending; on merge of that PR, publishes the CLI to npm via npm Trusted | |
| # Publishing (OIDC). No NPM_TOKEN — the `id-token: write` permission above | |
| # lets pnpm exchange a GitHub OIDC token for a short-lived npm token at | |
| # publish time. NPM_CONFIG_PROVENANCE attaches a signed provenance | |
| # attestation linking the package to this exact workflow run + commit. | |
| - name: Create release PR or publish CLI to npm | |
| id: changesets | |
| uses: changesets/action@v1 | |
| with: | |
| # `pnpm version` and `pnpm publish` are pnpm built-ins — they bypass | |
| # the package.json `scripts` block. Force the script lookup with `run` | |
| # so changeset version/publish actually execute. | |
| publish: pnpm run release | |
| version: pnpm run version | |
| commit: "chore(release): version packages" | |
| title: "chore(release): version packages" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_CONFIG_PROVENANCE: "true" | |
| # Stamp every deploy with the git commit so the live Worker can report it. | |
| # `--tag` populates Cloudflare's version_metadata, surfaced at GET /version | |
| # (the loop reads it to confirm WHICH commit is live, not just a UUID). | |
| # wrangler caps a tag at ~25 chars, so use the short SHA there; the full | |
| # SHA goes in `--message` (shown in `wrangler deployments list`). Both are | |
| # space-free single tokens — no shell-quoting in the wrangler-action input. | |
| - name: Compute deploy label | |
| id: ver | |
| env: | |
| FULL_SHA: ${{ github.sha }} | |
| run: echo "sha_short=${FULL_SHA:0:8}" >> "$GITHUB_OUTPUT" | |
| # Deploy order matters (D33 + outside-voice #3): deploy `web` first so | |
| # web-og's Service Binding has a target. Both deploys go in this single | |
| # job so OG_TEMPLATE_VERSION can't be mismatched across workers. | |
| - name: Deploy web | |
| uses: cloudflare/wrangler-action@v4 | |
| with: | |
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| workingDirectory: packages/web | |
| command: deploy --tag ${{ steps.ver.outputs.sha_short }} --message commit-${{ github.sha }} | |
| - name: Deploy web-og | |
| uses: cloudflare/wrangler-action@v4 | |
| with: | |
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| workingDirectory: packages/web-og | |
| command: deploy --tag ${{ steps.ver.outputs.sha_short }} --message commit-${{ github.sha }} |