Skip to content

Commit a801e10

Browse files
BRBussyclaude
BRBussy
and
claude
committed
feat(ci): Add separate npm deployment workflows for TypeScript SDKs
- Add ts-old-deploy.yml for @meshtrade/api-old (Legacy SDK) - Add ts-web-deploy.yml for @meshtrade/api-web (Web SDK with Connect-ES) - Add ts-node-deploy.yml for @meshtrade/api-node (Node SDK with Connect-ES) - Remove deprecated npm-deploy.yml (replaced by 3 separate workflows) Each workflow triggers on tags matching pattern: {sdk-type}/v*.*.* All use OIDC Trusted Publishing for secure npm deployment. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>
1 parent 8778268 commit a801e10

File tree

3 files changed

+448
-36
lines changed

3 files changed

+448
-36
lines changed

‎.github/workflows/ts-node-deploy.yml‎

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
name: Deploy TypeScript SDK (Node) to npm via OIDC Trusted Publishing
2+
3+
# Triggers on tags like ts-node/v1.0.0, ts-node/v2.1.3, etc.
4+
# Uses npm Trusted Publishing (OIDC) - no long-lived tokens required!
5+
# Requires npm CLI >= 11.5.1 and one-time trusted publisher config on npmjs.com
6+
on:
7+
push:
8+
tags:
9+
- 'ts-node/v*.*.*'
10+
11+
# Allows manual workflow dispatch
12+
workflow_dispatch:
13+
inputs:
14+
version:
15+
description: 'Version to publish (e.g., 1.2.3)'
16+
required: true
17+
type: string
18+
19+
permissions:
20+
contents: write # For committing version changes back to repository
21+
id-token: write # CRITICAL: Required for OIDC authentication with npm
22+
pull-requests: write # For creating PR after successful deployment
23+
24+
jobs:
25+
npm-deploy:
26+
runs-on: ubuntu-latest # Must use GitHub-hosted runner (self-hosted not supported for OIDC)
27+
steps:
28+
- name: Checkout
29+
uses: actions/checkout@v4
30+
31+
- name: Setup Node.js
32+
uses: actions/setup-node@v4
33+
with:
34+
node-version: '20'
35+
registry-url: 'https://registry.npmjs.org' # Required for OIDC authentication
36+
37+
- name: Upgrade npm to support OIDC
38+
run: |
39+
echo "Current npm version: $(npm --version)"
40+
npm install -g npm@latest
41+
echo "Updated npm version: $(npm --version)"
42+
echo "Note: OIDC requires npm >= 11.5.1"
43+
44+
- name: Enable Corepack
45+
run: corepack enable
46+
47+
- name: Cache dependencies
48+
uses: actions/cache@v4
49+
with:
50+
path: |
51+
node_modules
52+
.yarn/cache
53+
ts-node/node_modules
54+
key: ${{ runner.os }}-ts-node-deps-${{ hashFiles('yarn.lock', 'ts-node/yarn.lock') }}
55+
restore-keys: |
56+
${{ runner.os }}-ts-node-deps-
57+
58+
- name: Install dependencies
59+
run: yarn install --frozen-lockfile
60+
61+
- name: Setup buf CLI (required for protobuf generation)
62+
uses: bufbuild/buf-setup-action@v1
63+
with:
64+
github_token: ${{ github.token }}
65+
66+
- name: Generate TypeScript code from protobuf
67+
run: ./dev/tool.sh generate --targets=typescript
68+
69+
- name: Run TypeScript tests (early validation)
70+
working-directory: ./ts-node
71+
run: |
72+
echo "🧪 Running TypeScript tests..."
73+
yarn test
74+
75+
- name: Run TypeScript linting (early validation)
76+
working-directory: ./ts-node
77+
run: |
78+
echo "🔍 Linting TypeScript code..."
79+
yarn lint
80+
81+
- name: Extract version from tag or input
82+
id: version
83+
run: |
84+
if [[ "${{ github.event_name }}" == "push" ]]; then
85+
# Extract version from ts-node/v*.*.* tag (e.g., ts-node/v1.2.3 -> 1.2.3)
86+
VERSION=$(echo "${{ github.ref_name }}" | sed 's/^ts-node\/v//')
87+
echo "version=$VERSION" >> $GITHUB_OUTPUT
88+
echo "Extracted version from tag: $VERSION"
89+
else
90+
# Use version from manual workflow dispatch input
91+
VERSION="${{ inputs.version }}"
92+
echo "version=$VERSION" >> $GITHUB_OUTPUT
93+
echo "Using manual version input: $VERSION"
94+
fi
95+
96+
- name: Update package.json version
97+
working-directory: ./ts-node
98+
run: |
99+
VERSION="${{ steps.version.outputs.version }}"
100+
echo "Setting TypeScript package version to: $VERSION"
101+
# Use yarn version - the native and safe way to update package.json
102+
yarn version --new-version "$VERSION" --no-git-tag-version
103+
echo "Updated package.json version:"
104+
grep '"version":' package.json
105+
106+
- name: Build TypeScript SDK
107+
working-directory: ./ts-node
108+
run: |
109+
echo "🏗️ Building TypeScript SDK (Node)..."
110+
yarn build
111+
112+
- name: Verify build artifacts
113+
working-directory: ./ts-node
114+
run: |
115+
echo "✅ Verifying build artifacts..."
116+
ls -la dist/ | head -10
117+
118+
- name: Publish to npm via OIDC Trusted Publishing
119+
working-directory: ./ts-node
120+
run: |
121+
echo "🚀 Publishing to npm via OIDC Trusted Publishing..."
122+
echo "npm version: $(npm --version)"
123+
# OIDC handles authentication automatically - no tokens needed!
124+
# Provenance attestations are automatically generated with trusted publishing
125+
npm publish --access public
126+
127+
- name: Success notification
128+
run: |
129+
VERSION="${{ steps.version.outputs.version }}"
130+
echo ""
131+
echo "############################################################"
132+
echo "# #"
133+
echo "# 🎉 TypeScript SDK (Node) v$VERSION published! 🔐 #"
134+
echo "# #"
135+
echo "# Package: @meshtrade/api-node@$VERSION #"
136+
echo "# Registry: https://www.npmjs.com/package/@meshtrade/api-node #"
137+
echo "# Provenance: ✅ Automatically generated #"
138+
echo "# Authentication: OIDC (no long-lived tokens!) #"
139+
echo "# #"
140+
echo "############################################################"
141+
142+
- name: Create PR with version update
143+
if: success()
144+
env:
145+
GH_TOKEN: ${{ github.token }}
146+
run: |
147+
VERSION="${{ steps.version.outputs.version }}"
148+
BRANCH_NAME="chore/npm-ts-node-version-update-$VERSION"
149+
150+
echo "📝 Creating PR to commit version $VERSION back to repository..."
151+
152+
# Configure git
153+
git config --global user.name "github-actions[bot]"
154+
git config --global user.email "github-actions[bot]@users.noreply.github.com"
155+
156+
# Create and checkout new branch
157+
git checkout -b "$BRANCH_NAME"
158+
159+
# Add only the version change
160+
git add ts-node/package.json
161+
162+
# Commit the version change
163+
COMMIT_MSG="chore: update TypeScript SDK (Node) version to $VERSION
164+
165+
After successful deployment to npm registry via OIDC.
166+
Tag: ts-node/v$VERSION
167+
168+
🤖 Generated with [Claude Code](https://claude.ai/code)
169+
170+
Co-Authored-By: Claude <[email protected]>"
171+
git commit -m "$COMMIT_MSG"
172+
173+
# Push the branch
174+
git push origin "$BRANCH_NAME"
175+
176+
# Create PR using GitHub CLI
177+
PR_BODY="## Summary
178+
Updates TypeScript SDK (Node) version to $VERSION after successful npm deployment via OIDC.
179+
180+
## Details
181+
- Package successfully published to npm registry using OIDC Trusted Publishing
182+
- Provenance attestations automatically generated
183+
- No long-lived tokens used (secure OIDC authentication)
184+
- Version updated in \`ts-node/package.json\`
185+
- Triggered by tag: \`ts-node/v$VERSION\`
186+
187+
## Security
188+
- ✅ Published via OIDC (no npm tokens)
189+
- ✅ Provenance attestations included
190+
- ✅ Short-lived, workflow-specific credentials
191+
192+
## Checklist
193+
- [x] Version updated to match published package
194+
- [x] Package successfully deployed to npm
195+
- [x] OIDC authentication successful
196+
- [ ] Merged to main branch
197+
198+
🤖 Generated with [Claude Code](https://claude.ai/code)"
199+
200+
gh pr create \
201+
--title "chore: update TypeScript SDK (Node) version to $VERSION" \
202+
--body "$PR_BODY" \
203+
--base master \
204+
--head "$BRANCH_NAME"
205+
206+
echo "✅ PR created successfully!"

0 commit comments

Comments
 (0)