Merge pull request #52 from nestm-dev/codex/oauth-loopback-redirect #31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| id-token: write | |
| concurrency: release-${{ github.ref }} | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| environment: release | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: { fetch-depth: 0 } | |
| - uses: pnpm/setup@v2 | |
| with: | |
| install: false | |
| # Never set `registry-url` here: setup-node would write an auth-token | |
| # entry that takes precedence over npm trusted publishing. | |
| - uses: actions/setup-node@v7 | |
| with: { node-version: 24, cache: pnpm } | |
| - name: Require pnpm with native OIDC publishing | |
| run: >- | |
| node -e 'const [a,b]=require("child_process").execSync("pnpm --version").toString().trim().split(".").map(Number);if(a<11||(a===11&&b<11))throw new Error("pnpm >=11.11 required")' | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm run verify | |
| - name: Create release PR or publish to npm | |
| id: changesets | |
| uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| publish-script: pnpm run release | |
| version-script: pnpm run release:version | |
| pr-title: "chore: release @nestm/mcp" | |
| commit-message: "chore: release @nestm/mcp" | |
| create-github-releases: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Reconcile package tags | |
| if: always() | |
| run: | | |
| for MANIFEST in packages/*/package.json; do | |
| NAME=$(node -p "require('./$MANIFEST').name") | |
| VERSION=$(node -p "require('./$MANIFEST').version") | |
| PRIVATE=$(node -p "require('./$MANIFEST').private === true") | |
| if [ "$PRIVATE" = "true" ]; then continue; fi | |
| TAG="$NAME@$VERSION" | |
| if npm view "$NAME@$VERSION" version > /dev/null 2>&1; then | |
| git tag "$TAG" 2> /dev/null && git push origin "$TAG" || true | |
| fi | |
| done |