ci: pin Actions@SHA and disable cache on workflows with elevated OIDC… #223
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - next | |
| - alpha | |
| concurrency: ${{ github.workflow }}-${{ github.ref }} | |
| jobs: | |
| publish: | |
| if: github.repository == 'apollographql/apollo-client-integrations' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| # Create an access token for the Github Actions Bot app. This one has permissions | |
| # to push directly to this repository (only!) without required status checks. | |
| - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 | |
| id: github-actions-bot-app-token | |
| with: | |
| app-id: 819772 | |
| private-key: ${{ secrets.APOLLO_GITHUB_ACTIONS_BOT_PRIVATE_KEY }} | |
| # Check out the repository, using the Github Actions Bot app's token so that we | |
| # can push later and override required statuses. | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| token: ${{ steps.github-actions-bot-app-token.outputs.token }} | |
| # Fetch entire git history so Changesets can generate changelogs | |
| # with the correct commits | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e | |
| with: | |
| node-version: "24.x" | |
| registry-url: "https://registry.npmjs.org" | |
| # deliberately not using a cache for action with elevated permissions, see https://tanstack.com/blog/npm-supply-chain-compromise-postmortem | |
| package-manager-cache: false | |
| - run: | | |
| npm config set loglevel verbose | |
| npm config set foreground-scripts true | |
| - run: yarn install --immutable --mode=skip-build | |
| - name: Alpha branch - Enter prerelease mode (alpha by default) | |
| # If .changeset/pre.json does not exist and we did not recently exit | |
| # prerelease mode, enter prerelease mode with tag alpha | |
| if: (github.ref_name == 'next' || github.ref_name == 'alpha') && !contains(github.event.head_commit.message, 'Exit prerelease') | |
| run: | | |
| if ! test -f ".changeset/pre.json"; then | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git config user.name "github-actions[bot]" | |
| npx changeset pre enter alpha | |
| git add -A | |
| git commit -m 'Enter prerelease mode' | |
| git push | |
| fi | |
| - name: Append NPM token to .npmrc | |
| run: | | |
| cat << EOF > "$NPM_CONFIG_USERCONFIG" | |
| provenance=true | |
| //registry.npmjs.org/:_authToken=$NPM_TOKEN | |
| EOF | |
| env: | |
| NPM_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Create Release Pull Request or Publish to npm | |
| id: changesets | |
| uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b | |
| with: | |
| version: yarn changeset-version | |
| publish: yarn changeset-publish | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Output npm logs on failure | |
| if: failure() | |
| run: | | |
| echo "::group::NPM Debug Logs" | |
| for log in ~/.npm/_logs/*-debug*.log; do | |
| if [ -f "$log" ]; then | |
| echo "=== $log ===" | |
| cat "$log" | |
| echo "" | |
| fi | |
| done | |
| echo "::endgroup::" |