Publish: add workflow for dev publishing

Author: RasmusKjeldgaard

.github/workflows/publish-dev.yml

@@ -0,0 +1,43 @@
+name: Publish dev version to npm
+
+# Publishes a package and everything it depends on at <version>-dev-<short SHA>, under
+# the 'dev' dist-tag, so a consumer can verify an unreleased change in a real application.
+#
+# workflow_dispatch is available to anyone with write access, and a dispatched run
+# executes the workflow file as it exists on the selected ref — so an in-workflow actor
+# check would be deletable by the very person it is meant to stop. The admin gate is
+# therefore the 'npm-dev-publish' environment's required reviewers, which are repository
+# settings and cannot be edited from a branch. That environment name is also registered
+# in each package's npm trusted publisher configuration, so a run that drops the
+# 'environment' key to dodge the reviewer produces an OIDC token npm will reject.
+on:
+  workflow_dispatch:
+    inputs:
+      package:
+        description: 'Package to publish. Everything it depends on is published with it.'
+        required: true
+        type: choice
+        options:
+          - core
+          - designsystem
+          - extensions-angular
+          - stylelint-plugin
+
+permissions:
+  id-token: write # Required for OIDC (https://docs.github.com/en/actions/concepts/security/openid-connect)
+  contents: read
+
+jobs:
+  publish_dev:
+    name: Publish ${{ inputs.package }} (dev)
+    runs-on: ubuntu-latest
+    # Gates the whole job rather than a later step, so nothing from the dispatched ref
+    # runs before an admin has approved.
+    environment: npm-dev-publish
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Kirby setup
+        uses: ./.github/actions/kirby-setup
+      - name: Build and publish dev version to npm
+        run: npm run publish -- --dev ${{ inputs.package }}

scripts/publish.js

@@ -280,6 +280,43 @@ function applyDevVersions(packageNames, shortSha) {
   });
 }
 
+// Reports what a dev publish produced. A consumer must install the whole closure,
+// because each package's peer dependency range is pinned to the exact dev version of
+// the package below it. Written to the workflow run summary when running in Actions.
+function reportDevPublish(publishedPackages, shortSha) {
+  const installCommand = `npm install ${publishedPackages
+    .map(({ name, version }) => `${name}@${version}`)
+    .join(' ')}`;
+
+  console.log(`--- Dev publish of ${shortSha} complete ---`);
+  console.log(installCommand);
+
+  const summaryPath = process.env.GITHUB_STEP_SUMMARY;
+  if (!summaryPath) {
+    return;
+  }
+
+  const summary = [
+    `## Dev publish of \`${shortSha}\``,
+    '',
+    '| Package | Version |',
+    '| --- | --- |',
+    ...publishedPackages.map(({ name, version }) => `| \`${name}\` | \`${version}\` |`),
+    '',
+    'Install the whole set — the peer dependency ranges are pinned to these exact versions:',
+    '',
+    '```sh',
+    installCommand,
+    '```',
+    '',
+    'Dev versions are permanent, unsupported and never removed. Do not reference one from',
+    'a production dependency.',
+    '',
+  ].join('\n');
+
+  fs.appendFileSync(summaryPath, summary);
+}
+
 // Resolves as true only when the registry positively reports the version. A network
 // failure resolves as false, so we attempt the publish and let it fail loudly rather
 // than silently skipping a package that was never published.
@@ -422,15 +459,22 @@ async function main() {
 
   const packagesToPublish = resolvePackagesToPublish();
 
-  if (isDevPublish) {
-    const shortSha = shortCommitSha();
-    console.log(`--- Dev publish of [${packagesToPublish.join(', ')}] at ${shortSha} ---`);
-    applyDevVersions(packagesToPublish, shortSha);
+  if (!isDevPublish) {
+    for (const packageName of packagesToPublish) {
+      await publishPipelines[packageName]();
+    }
+    return;
   }
 
+  const shortSha = shortCommitSha();
+  console.log(`--- Dev publish of [${packagesToPublish.join(', ')}] at ${shortSha} ---`);
+  const publishedPackages = applyDevVersions(packagesToPublish, shortSha);
+
   for (const packageName of packagesToPublish) {
     await publishPipelines[packageName]();
   }
+
+  reportDevPublish(publishedPackages, shortSha);
 }
 
 main().catch((error) => {