FEC-881- CC signed commit (#1450) #595
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| id-token: write | |
| contents: read | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| # Get GitHub token via the CT Changesets App | |
| - name: Generate GitHub token (via CT Changesets App) | |
| id: generate_github_token | |
| uses: tibdex/github-app-token@v2.1.0 | |
| with: | |
| app_id: ${{ secrets.CT_CHANGESETS_APP_ID }} | |
| private_key: ${{ secrets.CT_CHANGESETS_APP_PEM }} | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| with: | |
| # Pass a personal access token (using our `ct-changesets` app) to be able to trigger other workflows | |
| # https://help.github.com/en/actions/reference/events-that-trigger-workflows#triggering-new-workflows-using-a-personal-access-token | |
| # https://github.community/t/action-does-not-trigger-another-on-push-tag-action/17148/8 | |
| token: ${{ steps.generate_github_token.outputs.token }} | |
| # Ensure we are using valid node version for npm trusted publising AFTER checkout | |
| # https://docs.npmjs.com/trusted-publishers#github-actions-configuration | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "24.12" | |
| registry-url: "https://registry.npmjs.org" | |
| # Ensure npm 11.5.1 or later is installed for OIDC support | |
| - name: Update npm | |
| run: npm install -g npm@latest | |
| - name: Verify npm version | |
| run: npm --version | |
| - name: Installing dependencies and building packages | |
| uses: ./.github/actions/ci | |
| # Configure npm registry for trusted publishing (OIDC) | |
| # This must run AFTER the CI action to override the Node setup with registry config | |
| # https://docs.npmjs.com/trusted-publishers#github-actions-configuration | |
| - name: Setup npm registry for publishing | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "24.12" | |
| registry-url: "https://registry.npmjs.org" | |
| - name: Storing release version for changeset | |
| id: release_version | |
| run: echo "VALUE=$(./scripts/print_release_version.sh)" >> $GITHUB_OUTPUT | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ steps.generate_github_token.outputs.token }} | |
| - name: Creating release pull request or publishing release to npm registry | |
| id: changesets | |
| uses: changesets/action@v1.7.0 | |
| with: | |
| publish: pnpm changeset publish | |
| version: pnpm changeset:version-and-format | |
| commit: "ci(changesets): version packages" | |
| title: "ci(changesets): version packages" | |
| createGithubReleases: true | |
| commitMode: "github-api" | |
| env: | |
| GITHUB_TOKEN: ${{ steps.generate_github_token.outputs.token }} | |
| SKIP_POSTINSTALL_DEV_SETUP: true | |
| # Publish canary releases only if the packages weren't published already | |
| - name: Regenerate GitHub token for canary | |
| if: steps.changesets.outputs.published != 'true' && github.ref == | |
| 'refs/heads/main' | |
| id: generate_github_token_canary | |
| uses: tibdex/github-app-token@v2.1.0 | |
| with: | |
| app_id: ${{ secrets.CT_CHANGESETS_APP_ID }} | |
| private_key: ${{ secrets.CT_CHANGESETS_APP_PEM }} | |
| - name: Publishing canary releases to npm registry | |
| if: steps.changesets.outputs.published != 'true' && github.ref == | |
| 'refs/heads/main' | |
| run: | | |
| set -euo pipefail | |
| git fetch origin main | |
| git reset --hard origin/main | |
| git clean -fd | |
| pnpm changeset version --snapshot canary | |
| pnpm changeset publish --tag canary | |
| env: | |
| GITHUB_TOKEN: ${{ steps.generate_github_token_canary.outputs.token }} |