Skip to content

Commit 60eb158

Browse files
rfgamaralrfgamaral
authored
ci: Fix release workflow and update configuration (#1119)
1 parent 5437618 commit 60eb158

File tree

8 files changed

+1519
-1575
lines changed

8 files changed

+1519
-1575
lines changed

‎.github/workflows/check-ci-validation.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ env:
1313
GH_PACKAGES_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
1414

1515
concurrency:
16-
group: check-ci-validation-${{ github.ref }}
16+
group: ${{ github.workflow }}-${{ github.ref }}
1717
cancel-in-progress: true
1818

1919
jobs:
@@ -24,17 +24,17 @@ jobs:
2424

2525
steps:
2626
- name: Checkout repository
27-
uses: actions/checkout@v4
27+
uses: actions/checkout@v5
2828

2929
- name: Prepare Node.js environment
30-
uses: actions/setup-node@v3
30+
uses: actions/setup-node@v6
3131
with:
3232
cache: npm
3333
node-version-file: .node-version
3434

3535
- name: Cache project 'node_modules' directory
36-
uses: actions/cache@v4
3736
id: node-modules-cache
37+
uses: actions/cache@v4
3838
with:
3939
key: node-modules-cache-${{ hashFiles('**/package-lock.json', '**/.node-version') }}
4040
path: node_modules/
@@ -54,17 +54,17 @@ jobs:
5454

5555
steps:
5656
- name: Checkout repository
57-
uses: actions/checkout@v4
57+
uses: actions/checkout@v5
5858

5959
- name: Prepare Node.js environment
60-
uses: actions/setup-node@v3
60+
uses: actions/setup-node@v6
6161
with:
6262
cache: npm
6363
node-version-file: .node-version
6464

6565
- name: Cache project 'node_modules' directory
66-
uses: actions/cache@v4
6766
id: node-modules-cache
67+
uses: actions/cache@v4
6868
with:
6969
key: node-modules-cache-${{ hashFiles('**/package-lock.json', '**/.node-version') }}
7070
path: node_modules/
@@ -96,17 +96,17 @@ jobs:
9696

9797
steps:
9898
- name: Checkout repository
99-
uses: actions/checkout@v4
99+
uses: actions/checkout@v5
100100

101101
- name: Prepare Node.js environment
102-
uses: actions/setup-node@v3
102+
uses: actions/setup-node@v6
103103
with:
104104
cache: npm
105105
node-version-file: .node-version
106106

107107
- name: Cache project 'node_modules' directory
108-
uses: actions/cache@v4
109108
id: node-modules-cache
109+
uses: actions/cache@v4
110110
with:
111111
key: node-modules-cache-${{ hashFiles('**/package-lock.json', '**/.node-version') }}
112112
path: node_modules/
@@ -130,17 +130,17 @@ jobs:
130130

131131
steps:
132132
- name: Checkout repository
133-
uses: actions/checkout@v4
133+
uses: actions/checkout@v5
134134

135135
- name: Prepare Node.js environment
136-
uses: actions/setup-node@v3
136+
uses: actions/setup-node@v6
137137
with:
138138
cache: npm
139139
node-version-file: .node-version
140140

141141
- name: Cache project 'node_modules' directory
142-
uses: actions/cache@v4
143142
id: node-modules-cache
143+
uses: actions/cache@v4
144144
with:
145145
key: node-modules-cache-${{ hashFiles('**/package-lock.json', '**/.node-version') }}
146146
path: node_modules/

‎.github/workflows/check-semantic-pull-request.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,6 @@ on:
77
- opened
88
- synchronize
99

10-
env:
11-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
12-
1310
jobs:
1411
validate-title:
1512
name: Validate Title
@@ -19,3 +16,5 @@ jobs:
1916
steps:
2017
- name: Validate pull request title
2118
uses: amannn/action-semantic-pull-request@01d5fd8a8ebb9aafe902c40c53f0f4744f7381eb
19+
env:
20+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/publish-typist-package-release.yml‎ renamed to ‎.github/workflows/publish-package-release.yml‎

Lines changed: 29 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Typist Package Release
1+
name: Package Release
22

33
on:
44
workflow_run:
@@ -9,23 +9,26 @@ on:
99
types:
1010
- completed
1111

12+
env:
13+
GH_PACKAGES_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
14+
1215
permissions:
13-
# Enable the use of OIDC for npm provenance
16+
# Enable the use of OIDC for trusted publishing and npm provenance
1417
id-token: write
1518
# Enable the use of GitHub Packages registry
1619
packages: write
17-
# Enable `semantic-release` to publish a GitHub release and post comments on issues/PRs
20+
# Enable `semantic-release` to publish a GitHub release
1821
contents: write
22+
# Enable `semantic-release` to post comments on issues
1923
issues: write
24+
# Enable `semantic-release` to post comments on pull requests
2025
pull-requests: write
2126

22-
# The release workflow involves many crucial steps that once triggered it shouldn't be cancelled
23-
# until it's finished, otherwise we might end up in an inconsistent state (e.g., a new release
24-
# published to npm but not GitHub Packages). To prevent this, concurrency is disabled with
25-
# `cancel-in-progress: false`, and new workflow runs will be queued to be started only when the
26-
# previous one has completely finished.
27+
# The release workflow involves many crucial steps that once triggered shouldn't be cancelled until
28+
# finished, otherwise we might end up in an inconsistent state (e.g., published to GitHub Packages
29+
# but not npm), so new workflow runs are queued until the previous one has completely finished.
2730
concurrency:
28-
group: typist-package-release
31+
group: ${{ github.workflow }}
2932
cancel-in-progress: false
3033

3134
jobs:
@@ -38,19 +41,19 @@ jobs:
3841

3942
steps:
4043
- name: Checkout repository
41-
uses: actions/checkout@v4
44+
uses: actions/checkout@v5
4245
with:
4346
token: ${{ secrets.GH_REPO_TOKEN }}
4447

4548
- name: Prepare Node.js environment
46-
uses: actions/setup-node@v3
49+
uses: actions/setup-node@v6
4750
with:
4851
cache: npm
4952
node-version-file: .node-version
5053

5154
- name: Cache project 'node_modules' directory
52-
uses: actions/cache@v4
5355
id: node-modules-cache
56+
uses: actions/cache@v4
5457
with:
5558
key: node-modules-cache-${{ hashFiles('**/package-lock.json', '**/.node-version') }}
5659
path: node_modules/
@@ -64,7 +67,14 @@ jobs:
6467
run: |
6568
npm run build
6669
67-
- name: Run automated package publishing
70+
# The Node.js environment is prepared based on the `.npmrc` file in the repo, which
71+
# configures Doist scoped packages to use the GitHub Packages registry for the initial
72+
# `semantic-release` publish, after which we remove the Doist registry configuration,
73+
# prepare the Node.js environment for the public npm registry with OIDC authentication,
74+
# and update npm to the latest version (required for trusted publishing support),
75+
# providing a predictable release workflow for both registries.
76+
77+
- name: Publish package to private GitHub Packages registry
6878
id: semantic-release
6979
run: |
7080
npx semantic-release
@@ -80,23 +90,20 @@ jobs:
8090
run: |
8191
npm config delete @doist:registry --location=project
8292
83-
- name: Prepare Node.js environment for GitHub Packages
84-
uses: actions/setup-node@v3
93+
- name: Prepare Node.js environment for npm registry
94+
uses: actions/setup-node@v6
8595
if: ${{ steps.semantic-release.outputs.package-published == 'true' }}
8696
with:
8797
cache: npm
8898
node-version-file: .node-version
89-
registry-url: https://npm.pkg.github.com/
99+
registry-url: https://registry.npmjs.org/
90100
scope: '@doist'
91101

92-
- name: Disable npm package provenance (unsupported by GitHub Packages)
102+
- name: Update npm for trusted publishing (requires 11.5.1 or later)
93103
if: ${{ steps.semantic-release.outputs.package-published == 'true' }}
94-
run: |
95-
npm config set provenance false --location=project
104+
run: npm install -g npm@latest
96105

97-
- name: Publish package to GitHub Packages
106+
- name: Publish package to public npm registry
98107
if: ${{ steps.semantic-release.outputs.package-published == 'true' }}
99108
run: |
100109
npm publish
101-
env:
102-
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/update-license-copyright-year.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212

1313
steps:
1414
- name: Checkout repository
15-
uses: actions/checkout@v4
15+
uses: actions/checkout@v5
1616
with:
1717
token: ${{ secrets.GH_REPO_TOKEN }}
1818

‎.node-version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
v22
1+
22.14

‎.npmrc‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,11 @@
1-
# Ensure dependencies are installed from the npm Registry instead of GitHub Packages in case you
2-
# have changed the default registry for the `@doist` scope in a parent `.npmrc` file
3-
@doist:registry=https://registry.npmjs.org/
1+
# Set the base URL for Doist's scoped package registry
2+
@doist:registry=https://npm.pkg.github.com/
43

5-
# Force npm to always require authentication when accessing the registry
6-
always-auth=true
4+
# Authenticate to GitHub Packages with a personal access token
5+
//npm.pkg.github.com/:_authToken=${GH_PACKAGES_TOKEN}
76

87
# Refuse to install any package incompatible with the current Node.js version
98
engine-strict=true
109

1110
# Save dependencies with an exact version rather than the semver range
1211
save-exact=true
13-
14-
# Generate provenance statements for published packages
15-
provenance=true

0 commit comments

Comments
 (0)