Skip to content

Commit dd59c41

Browse files
sarayevsarayev
committed
chore: add a new workflow for npm publish with trusted publishing
1 parent a9e970f commit dd59c41

File tree

4 files changed

+104
-42
lines changed

4 files changed

+104
-42
lines changed

‎.github/workflows/callable-npm-publish-lts-release.yml‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,19 @@ on:
1010
jobs:
1111
deploy:
1212
name: Publish to Amplify Package
13+
secrets: inherit
14+
uses: ./.github/workflows/callable-npm-publish-trusted.yml
15+
with:
16+
target: ${{ inputs.target }}
17+
github_user: ${{ vars.GH_USER}}
18+
github_email: ${{ vars.GH_EMAIL}}
19+
20+
post-deploy:
21+
name: Post-deployment tasks
1322
runs-on: ubuntu-latest
23+
needs: deploy
24+
permissions:
25+
contents: write
1426
steps:
1527
- name: Checkout repository
1628
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -20,17 +32,6 @@ jobs:
2032
# Minimal depth 0 so we can fetch all git tags.
2133
fetch-depth: 0
2234

23-
- name: Setup node and build the repository
24-
uses: ./amplify-js/.github/actions/node-and-build
25-
26-
- name: Run npm publish
27-
uses: ./amplify-js/.github/actions/npm-publish
28-
with:
29-
target: ${{ inputs.target }}
30-
npm_token: ${{ secrets.NPM_TOKEN }}
31-
github_user: ${{ vars.GH_USER}}
32-
github_email: ${{ vars.GH_EMAIL}}
33-
3435
- name: Set github commit user
3536
env:
3637
GITHUB_EMAIL: ${{ vars.GH_EMAIL }}
@@ -39,6 +40,9 @@ jobs:
3940
git config --global user.email $GITHUB_EMAIL
4041
git config --global user.name $GITHUB_USER
4142
43+
- name: Setup node for docs generation
44+
uses: ./amplify-js/.github/actions/node-and-build
45+
4246
- name: Update API documentation
4347
working-directory: ./amplify-js
4448
run: |

‎.github/workflows/callable-npm-publish-preid.yml‎

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ on:
1212
type: boolean
1313

1414
jobs:
15-
deploy:
16-
name: Publish to Amplify Package
15+
validate-preid:
16+
name: Validate preid
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: Forbidden and protected preid protection
@@ -30,19 +30,13 @@ jobs:
3030
[[ $ALLOW_PROTECTED_PREIDS == 'false' ]] && for e in $PROTECTED_PREIDS; do [[ $PREID == $e ]] && echo "$PREID is protected from preid release" && exit 1; done
3131
echo "$PREID is allowed for preid release"
3232
33-
- name: Checkout repository
34-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
35-
with:
36-
path: amplify-js
37-
38-
- name: Setup node and build the repository
39-
uses: ./amplify-js/.github/actions/node-and-build
40-
41-
- name: Run npm publish
42-
uses: ./amplify-js/.github/actions/npm-publish
43-
with:
44-
target: preid
45-
preid: ${{ inputs.preid }}
46-
npm_token: ${{ secrets.NPM_TOKEN }}
47-
github_user: ${{ vars.GH_USER}}
48-
github_email: ${{ vars.GH_EMAIL}}
33+
deploy:
34+
name: Publish to Amplify Package
35+
needs: validate-preid
36+
secrets: inherit
37+
uses: ./.github/workflows/callable-npm-publish-trusted.yml
38+
with:
39+
target: preid
40+
preid: ${{ inputs.preid }}
41+
github_user: ${{ vars.GH_USER}}
42+
github_email: ${{ vars.GH_EMAIL}}

‎.github/workflows/callable-npm-publish-release.yml‎

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,20 @@ jobs:
1616

1717
deploy:
1818
name: Publish to Amplify Package
19-
runs-on: ubuntu-latest
2019
needs: deploy-prep
20+
secrets: inherit
21+
uses: ./.github/workflows/callable-npm-publish-trusted.yml
22+
with:
23+
target: release
24+
github_user: ${{ vars.GH_USER}}
25+
github_email: ${{ vars.GH_EMAIL}}
26+
27+
post-deploy:
28+
name: Post-deployment tasks
29+
runs-on: ubuntu-latest
30+
needs: [deploy-prep, deploy]
31+
permissions:
32+
contents: write
2133
steps:
2234
- name: Checkout repository
2335
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -27,17 +39,6 @@ jobs:
2739
# Minimal depth 0 so we can fetch all git tags.
2840
fetch-depth: 0
2941

30-
- name: Setup node and build the repository
31-
uses: ./amplify-js/.github/actions/node-and-build
32-
33-
- name: Run npm publish
34-
uses: ./amplify-js/.github/actions/npm-publish
35-
with:
36-
target: release
37-
npm_token: ${{ secrets.NPM_TOKEN }}
38-
github_user: ${{ vars.GH_USER}}
39-
github_email: ${{ vars.GH_EMAIL}}
40-
4142
- name: Set github commit user
4243
env:
4344
GITHUB_EMAIL: ${{ vars.GH_EMAIL }}
@@ -54,6 +55,9 @@ jobs:
5455
RELEASE_COMMIT_MESSAGE=$(git log -n 1 --skip 1 --pretty=oneline)
5556
if [[ $RELEASE_COMMIT_MESSAGE = *release\(required\)* ]]; then git tag -f required-release $PUBLISH_COMMIT_HASH; fi
5657
58+
- name: Setup node for docs generation
59+
uses: ./amplify-js/.github/actions/node-and-build
60+
5761
- name: Update API documentation
5862
working-directory: ./amplify-js
5963
run: |
@@ -75,4 +79,4 @@ jobs:
7579
run: |
7680
git checkout -b $TEMP_BRANCH_NAME
7781
git push origin $TEMP_BRANCH_NAME
78-
gh pr create -B main -H $TEMP_BRANCH_NAME --title 'chore: Merge release into main' --body 'Merge the recently completed release back into the main development branch. Generated by the callable-npm-publish-release workflow.'
82+
gh pr create -B main -H $TEMP_BRANCH_NAME --title 'chore: Merge release into main' --body 'Merge the recently completed release back into the main development branch. Generated by the callable-npm-publish-release workflow.'

‎.github/workflows/callable-npm-publish-trusted.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Trusted npm publisher with OIDC authentication
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
github_user:
7+
description: The git user to make commits with
8+
required: true
9+
type: string
10+
github_email:
11+
description: The git email to make commits with
12+
required: true
13+
type: string
14+
target:
15+
description: The release process target (either release or preid)
16+
required: true
17+
type: string
18+
preid:
19+
description: The preid to release to when the target is preid
20+
required: false
21+
type: string
22+
23+
jobs:
24+
publish:
25+
name: Publish to npm with trusted authentication
26+
runs-on: ubuntu-latest
27+
permissions:
28+
contents: read
29+
id-token: write # Required for npm trusted publishers
30+
steps:
31+
- name: Checkout repository
32+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
33+
with:
34+
path: amplify-js
35+
token: ${{ secrets.GH_TOKEN_AMPLIFY_JS_WRITE }}
36+
# Minimal depth 0 so we can fetch all git tags.
37+
fetch-depth: 0
38+
39+
- name: Setup node and build the repository
40+
uses: ./amplify-js/.github/actions/node-and-build
41+
42+
- name: Authenticate with npm (trusted publishers)
43+
id: npm-auth
44+
run: |
45+
if [ -n "$NPM_TOKEN" ]; then
46+
echo "Using npm trusted publishers authentication"
47+
echo "auth_token=$NPM_TOKEN" >> "$GITHUB_OUTPUT"
48+
else
49+
echo "Error: NPM_TOKEN not provided by trusted publishers"
50+
exit 1
51+
fi
52+
53+
- name: Run npm publish
54+
uses: ./amplify-js/.github/actions/npm-publish
55+
with:
56+
target: ${{ inputs.target }}
57+
preid: ${{ inputs.preid }}
58+
npm_token: ${{ steps.npm-auth.outputs.auth_token }}
59+
github_user: ${{ inputs.github_user }}
60+
github_email: ${{ inputs.github_email }}

0 commit comments

Comments
 (0)