|
2 | 2 |
|
3 | 3 | name: Release [Manual] |
4 | 4 | on: workflow_dispatch |
| 5 | + |
5 | 6 | permissions: |
6 | 7 | contents: write |
7 | | - id-token: write |
| 8 | + id-token: write # REQUIRED for trusted publishing |
| 9 | + |
8 | 10 | jobs: |
9 | 11 | Release: |
10 | 12 | runs-on: ubuntu-latest |
| 13 | + # Specify environment if you configured one in npm |
| 14 | + # environment: production # Uncomment if you set an environment name in npm trusted publisher settings |
| 15 | + |
11 | 16 | steps: |
12 | 17 | - uses: actions/checkout@v3 |
13 | 18 | with: |
14 | 19 | # fetch-depth is necessary to get all tags |
15 | 20 | # otherwise lerna can't detect the changes and will end up bumping the versions for all packages |
16 | 21 | fetch-depth: 0 |
17 | 22 | token: ${{ secrets.RELEASE_COMMIT_GH_PAT }} |
| 23 | + |
18 | 24 | - name: Setup Node |
19 | | - uses: actions/setup-node@v4 |
| 25 | + uses: actions/setup-node@v4 # UPDATED to v4 |
20 | 26 | with: |
21 | 27 | node-version: '22' |
22 | | - registry-url: "https://registry.npmjs.org/" |
23 | | - provenance: true # enables trusted publish via OIDC |
| 28 | + registry-url: 'https://registry.npmjs.org' |
| 29 | + always-auth: false # important for trusted publishing |
| 30 | + |
24 | 31 | - name: Configure CI Git User |
25 | 32 | run: | |
26 | 33 | git config --global user.name $CONFIG_USERNAME |
27 | 34 | git config --global user.email $CONFIG_EMAIL |
28 | | - git remote set-url origin https://$GITHUB_ACTOR:[email protected]/sourcefuse/arc-saas |
| 35 | + git remote set-url origin https://$GITHUB_ACTOR:[email protected]/sourcefuse/loopback4-authorization |
29 | 36 | env: |
30 | 37 | GITHUB_PAT: ${{ secrets.RELEASE_COMMIT_GH_PAT }} |
31 | 38 | CONFIG_USERNAME: ${{ vars.RELEASE_COMMIT_USERNAME }} |
32 | 39 | CONFIG_EMAIL: ${{ vars.RELEASE_COMMIT_EMAIL }} |
33 | 40 |
|
34 | | - - name: Bootstrap |
35 | | - run: npm ci |
36 | | - # this step is added only since this version of nx dependency is not being installed on linux systems |
37 | | - # can be removed once this issue is fixed or we update to later versions |
38 | | - - name: nx dependency |
39 | | - |
40 | | - - name: Test |
41 | | - run: npm run test --workspaces --if-present |
42 | | - - name: Lint |
43 | | - run: npm run lint --workspaces --if-present |
44 | | - - name: Stash Changes |
45 | | - run: git stash |
46 | | - - name: Bump Versions |
47 | | - # "HUSKY=0" disables pre-commit-msg check (Needed in order to allow lerna perform the release commit) |
48 | | - # run: HUSKY=0 npx lerna version --yes --ci --conventional-commits |
49 | | - # Bumping major version for release will remove once released |
50 | | - run: HUSKY=0 npx lerna version --yes --ci --conventional-commits |
51 | | - # 🟢 This replaces 'lerna publish from-package --yes --provenance' |
52 | | - # and replicates its logic safely while keeping provenance and trusted publishing. |
53 | | - - name: Publish all changed packages |
| 41 | + - name: Install 📌 |
| 42 | + run: npm install |
| 43 | + |
| 44 | + - name: Test 🔧 |
| 45 | + run: npm run test |
| 46 | + |
| 47 | + # ✅ CHANGED THIS SECTION |
| 48 | + - name: Semantic Publish to NPM 🚀 |
54 | 49 | run: | |
55 | | - echo "🚀 Publishing packages from-package with provenance..." |
56 | | - npx lerna publish from-package --yes --registry https://registry.npmjs.org/ |
| 50 | + npm config set provenance true |
| 51 | + HUSKY=0 npx semantic-release |
| 52 | + env: |
| 53 | + GH_TOKEN: ${{ secrets.RELEASE_COMMIT_GH_PAT }} |
| 54 | + # REMOVED: NPM_TOKEN is not needed with trusted publishing |
| 55 | + # The id-token: write permission above handles authentication |
| 56 | + |
| 57 | + - name: Changelog 📝 |
| 58 | + run: cd src/release_notes && HUSKY=0 node release-notes.js |
0 commit comments