Skip to content

Commit ca006f8

Browse files
mandarinimandarini
committed
chore(ci): show perms
1 parent bdd4b7e commit ca006f8

File tree

1 file changed

+7
-224
lines changed

1 file changed

+7
-224
lines changed

‎.github/workflows/publish.yml‎

Lines changed: 7 additions & 224 deletions
Original file line numberDiff line numberDiff line change
@@ -1,135 +1,15 @@
11
name: Publish releases
2-
# Consolidates canary and stable releases into single workflow
3-
# Trusted workflow for publishing to npm
42

53
on:
6-
push:
7-
branches: [master]
84
workflow_dispatch:
9-
inputs:
10-
version_specifier:
11-
description: 'Semver bump (patch|minor|major|pre*) or exact version (v1.2.3)'
12-
required: true
13-
type: string
145

156
env:
167
NODE_VERSION: '20'
178

189
jobs:
19-
# release-stable: # stable releases can only be manually triggered
20-
# if: ${{ github.event_name == 'workflow_dispatch' }}
21-
# runs-on: ubuntu-latest
22-
# permissions:
23-
# contents: read
24-
# id-token: write
25-
26-
# steps:
27-
# - name: Generate token
28-
# id: app-token
29-
# uses: actions/create-github-app-token@v2
30-
# with:
31-
# app-id: ${{ secrets.APP_ID }}
32-
# private-key: ${{ secrets.PRIVATE_KEY }}
33-
# - name: Check if actor is member of admin or client-libs team
34-
# id: team-check
35-
# uses: actions/github-script@v7
36-
# with:
37-
# github-token: ${{ steps.app-token.outputs.token }}
38-
# script: |
39-
# const org = 'supabase'
40-
# const { actor } = context
41-
42-
# async function isTeamMember(team_slug) {
43-
# try {
44-
# const res = await github.rest.teams.getMembershipForUserInOrg({
45-
# org,
46-
# team_slug,
47-
# username: actor,
48-
# })
49-
# return res && res.status === 200
50-
# } catch (_) {
51-
# return false
52-
# }
53-
# }
54-
# const isAdmin = await isTeamMember('admin')
55-
# const isClientLibs = await isTeamMember('client-libs')
56-
# const isMember = isAdmin || isClientLibs
57-
# core.setOutput('is_team_member', isMember ? 'true' : 'false')
58-
59-
# - name: Fail if not authorized
60-
# if: ${{ steps.team-check.outputs.is_team_member != 'true' }}
61-
# run: |
62-
# echo "You must be a member of @supabase/admin or @supabase/client-libs."
63-
# exit 1
64-
65-
# - uses: actions/checkout@v5
66-
# with:
67-
# fetch-depth: 0
68-
69-
# - uses: actions/setup-node@v4
70-
# with:
71-
# node-version: ${{ env.NODE_VERSION }}
72-
# cache: 'npm'
73-
# registry-url: 'https://registry.npmjs.org'
74-
75-
# # Ensure npm 11.5.1 or later is installed for trusted publishing support
76-
# - name: Update npm
77-
# run: npm install -g npm@latest
78-
79-
# - name: Install dependencies
80-
# run: npm ci --legacy-peer-deps
81-
82-
# - name: Configure git
83-
# run: |
84-
# git config --global user.name "supabase-releaser[bot]"
85-
# git config --global user.email "supabase-releaser[bot]@users.noreply.github.com"
86-
87-
# - name: Validate input
88-
# run: |
89-
# VS="${{ github.event.inputs.version_specifier }}"
90-
# echo "Validating: $VS"
91-
92-
# if [[ "$VS" =~ ^(patch|minor|major|prepatch|preminor|premajor|prerelease)$ ]]; then
93-
# echo "✔ bump keyword"
94-
# elif [[ "$VS" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
95-
# echo "✔ explicit version"
96-
# else
97-
# echo "❌ Invalid version_specifier: '$VS'"
98-
# echo " Use: patch|minor|major|pre*, or v1.2.3"
99-
# exit 1
100-
# fi
101-
102-
# - name: Release & create PR
103-
# env:
104-
# NPM_CONFIG_PROVENANCE: true
105-
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
106-
# RELEASE_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
107-
# GH_TOKEN: ${{ steps.app-token.outputs.token }}
108-
# run: |
109-
# npm run release-stable -- --versionSpecifier "${{ github.event.inputs.version_specifier }}"
110-
111-
# - name: Summary
112-
# if: ${{ success() }}
113-
# run: |
114-
# echo "## ✅ Stable Release" >> $GITHUB_STEP_SUMMARY
115-
# echo "- **Version specifier:** \`${{ github.event.inputs.version_specifier }}\`" >> $GITHUB_STEP_SUMMARY
116-
# echo "- **Source commit:** HEAD of the checked-out branch" >> $GITHUB_STEP_SUMMARY
117-
# echo "- **Dist-tag:** \`latest\`" >> $GITHUB_STEP_SUMMARY
118-
119-
# docs-after-stable-release:
120-
# name: Generate Documentation
121-
# needs: release-stable
122-
# if: ${{ github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'success' }}
123-
# uses: ./.github/workflows/docs.yml
124-
# permissions:
125-
# actions: read
126-
# contents: write
127-
12810
trigger-update-js-libs:
12911
name: Trigger Update JS Libs
13012
runs-on: ubuntu-latest
131-
# needs: release-stable
132-
# if: ${{ github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'success' }}
13313
steps:
13414
- name: Generate token
13515
id: app-token
@@ -139,6 +19,10 @@ jobs:
13919
private-key: ${{ secrets.PRIVATE_KEY }}
14020
owner: supabase
14121
repositories: supabase, supabase-js
22+
23+
- name: Show token permissions
24+
run: |
25+
curl -H "Authorization: token ${{ steps.app-token.outputs.token }}" https://api.github.com/
14226
- name: Trigger supabase/supabase update-js-libs workflow
14327
uses: actions/github-script@v7
14428
with:
@@ -150,16 +34,14 @@ jobs:
15034
workflow_id: 'update-js-libs.yml',
15135
ref: 'master',
15236
inputs: {
153-
version: '${{ github.event.inputs.version_specifier }}',
37+
version: '2.74.0',
15438
source: 'supabase-js-stable-release'
15539
}
15640
});
15741
15842
trigger-supabase-docs-update:
15943
name: Trigger Supabase Docs Update
16044
runs-on: ubuntu-latest
161-
# needs: [release-stable, docs-after-stable-release]
162-
# if: ${{ github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'success' && needs.docs-after-stable-release.result == 'success' }}
16345
steps:
16446
- name: Generate token
16547
id: app-token
@@ -181,108 +63,9 @@ jobs:
18163
workflow_id: 'docs-js-libs-update.yml',
18264
ref: 'master',
18365
inputs: {
184-
version: '${{ github.event.inputs.version_specifier }}',
66+
version: '2.74.0',
18567
source: 'supabase-js-stable-release'
18668
}
18769
});
18870
189-
# preview jobs
190-
# ci-core:
191-
# if: ${{ github.event_name == 'push' }}
192-
# name: Core Packages CI
193-
# uses: ./.github/workflows/ci-core.yml
194-
# permissions:
195-
# actions: read
196-
# contents: read
197-
198-
# ci-supabase-js:
199-
# if: ${{ github.event_name == 'push' }}
200-
# name: Supabase-JS Integration CI
201-
# uses: ./.github/workflows/ci-supabase-js.yml
202-
# permissions:
203-
# actions: read
204-
# contents: read
205-
206-
# ci-auth-js-node18:
207-
# if: ${{ github.event_name == 'push' }}
208-
# name: Auth-JS Node.js 18 Compatibility
209-
# uses: ./.github/workflows/ci-auth-js-node18.yml
210-
# permissions:
211-
# actions: read
212-
# contents: read
213-
214-
# ==========================================
215-
# CANARY RELEASE (only on master, after all CI passes)
216-
# ==========================================
217-
218-
# release-canary:
219-
# name: Release Canary
220-
# runs-on: ubuntu-latest
221-
# needs: [ci-core, ci-supabase-js, ci-auth-js-node18]
222-
# permissions:
223-
# contents: read
224-
# id-token: write
225-
# # Only run on master branch pushes, and only if all CI jobs succeeded
226-
# if: |
227-
# github.ref == 'refs/heads/master' &&
228-
# github.event_name == 'push' &&
229-
# needs.ci-core.result == 'success' &&
230-
# needs.ci-supabase-js.result == 'success' &&
231-
# needs.ci-auth-js-node18.result == 'success'
232-
# steps:
233-
# - name: Generate token
234-
# id: app-token
235-
# uses: actions/create-github-app-token@v2
236-
# with:
237-
# app-id: ${{ secrets.APP_ID }}
238-
# private-key: ${{ secrets.PRIVATE_KEY }}
239-
240-
# - name: Checkout code
241-
# uses: actions/checkout@v5
242-
# with:
243-
# fetch-depth: 0
244-
245-
# - name: Setup Node.js
246-
# uses: actions/setup-node@v4
247-
# with:
248-
# node-version: ${{ env.NODE_VERSION }}
249-
# cache: 'npm'
250-
# registry-url: 'https://registry.npmjs.org'
251-
252-
# # Ensure npm 11.5.1 or later is installed for trusted publishing support
253-
# - name: Update npm
254-
# run: npm install -g npm@latest
255-
# - name: Install dependencies
256-
# run: npm ci --legacy-peer-deps
257-
# - name: Configure git
258-
# run: |
259-
# git config --global user.name "supabase-releaser[bot]"
260-
# git config --global user.email "supabase-releaser[bot]@users.noreply.github.com"
261-
262-
# - name: Release canary version
263-
# id: release
264-
# run: |
265-
# echo "Running nx release..."
266-
# npm run release-canary
267-
# env:
268-
# NPM_CONFIG_PROVENANCE: true
269-
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
270-
# RELEASE_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
271-
272-
# notify-stable-failure:
273-
# name: Notify Slack for Stable failure
274-
# # needs: release-stable
275-
# # if: ${{ always() && github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'failure' }}
276-
# uses: ./.github/workflows/slack-notify.yml
277-
# secrets: inherit
278-
# with:
279-
# subject: 'Stable Release'
280-
281-
# notify-canary-failure:
282-
# name: Notify Slack for Canary failure
283-
# needs: release-canary
284-
# if: ${{ always() && github.event_name == 'push' && needs.release-canary.result == 'failure' }}
285-
# uses: ./.github/workflows/slack-notify.yml
286-
# secrets: inherit
287-
# with:
288-
# subject: 'Canary Release'
71+

0 commit comments

Comments
 (0)