ci: one updater, one merge mechanism, and a strict supply-chain soak … #322
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| push: | |
| branches: [main] | |
| jobs: | |
| code: | |
| uses: cyberuni/.github/.github/workflows/pnpm-verify.yml@v2 | |
| with: | |
| os: '["ubuntu-latest"]' | |
| skip-playwright: true | |
| # Runs on the default branch immediately before `changeset publish`, so a tarball that | |
| # trips the gate blocks the release. It used to sit on the changesets "Version | |
| # Packages" PR instead, where it could never fire: a PR opened with the built-in | |
| # GITHUB_TOKEN does not trigger `on: pull_request`, so that PR gets zero checks and | |
| # the job attached to it was never once executed. | |
| # | |
| # A `needs:` of release, so it also runs on pushes that only open or update the | |
| # Version PR rather than publish. Deliberate — it fails closed. | |
| publish-gate: | |
| uses: cyberuni/.github/.github/workflows/pnpm-publish-gate.yml@v2 | |
| permissions: | |
| contents: read | |
| release: | |
| uses: cyberuni/.github/.github/workflows/pnpm-release-changeset-oidc.yml@v2 | |
| needs: [code, publish-gate] | |
| permissions: | |
| id-token: write | |
| contents: write | |
| pull-requests: write | |
| # docgen: | |
| # uses: cyberuni/.github/.github/workflows/pnpm-docs.yml@v2 | |
| # needs: release |