Configured OIDC connect for npm publish #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to npm | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| concurrency: | |
| group: npm-publish | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| if: github.ref_type == 'tag' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # required for GitHub Release | |
| id-token: write # required for npm provenance | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| registry-url: "https://registry.npmjs.org" | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| env: | |
| NODE_ENV: development # ensure devDependencies are installed | |
| # - name: Run lint (optional but recommended) | |
| # run: npm run lint --if-present | |
| # - name: Run tests | |
| # run: npm test --if-present | |
| - name: Build package | |
| run: npm run compile | |
| env: | |
| NODE_ENV: production # explicitly production during build | |
| - name: Validate version matches tag | |
| run: | | |
| PACKAGE_VERSION=$(node -p "require('./package.json').version") | |
| TAG_VERSION=${GITHUB_REF#refs/tags/v} | |
| if [ "$PACKAGE_VERSION" != "$TAG_VERSION" ]; then | |
| echo "Tag version ($TAG_VERSION) does not match package.json version ($PACKAGE_VERSION)" | |
| exit 1 | |
| fi | |
| - name: Ensure package does not already exist | |
| run: | | |
| PACKAGE_NAME=$(node -p "require('./package.json').name") | |
| PACKAGE_VERSION=$(node -p "require('./package.json').version") | |
| if npm view "$PACKAGE_NAME@$PACKAGE_VERSION" > /dev/null 2>&1; then | |
| echo "Version already published." | |
| exit 1 | |
| fi | |
| - name: Validate package contents | |
| run: | | |
| npm pack | |
| tar -tf *.tgz | |
| # Publishing is allowed via OIDC connection, so no need to set up npm auth token | |
| - name: Publish to npm | |
| run: npm publish --provenance --access public | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| generate_release_notes: true |