krm-stream/.github/workflows/release.yml at main · ConfigButler/krm-stream · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
# Prepare tags first, then validate the selected immutable commit exactly once.
# Publish the artifact from that CI run. If publishing fails, re-run failed jobs;
# the successful CI job and its artifact are reused.
name: release

on:
  workflow_dispatch:
    inputs:
      version:
        description: Existing stable release to recover (empty uses the current version)
        type: string
        default: ""
  push:
    branches: [main]

permissions:
  contents: read

# Serialize push and manual recovery runs. Correctness does not depend on every push running.
concurrency:
  group: release-main
  cancel-in-progress: false

jobs:
  prepare:
    name: prepare the release
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 40
    permissions:
      contents: write
      pull-requests: write
    outputs:
      needed: ${{ steps.target.outputs.needed }}
      sha: ${{ steps.target.outputs.sha }}
      version: ${{ steps.target.outputs.version }}
    steps:
      - id: release
        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

      # Release Please reads live main, which may have advanced since this run began.
      # Resolve tags before CI so the selected release, rather than the older push, is tested.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
      - id: target
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ inputs.version || steps.release.outputs['packages/krm-stream--version'] }}
        run: node .github/scripts/release.mjs resolve

      - name: wait for Go release checksum records
        if: steps.target.outputs.needed == 'true'
        env:
          VERSION: ${{ steps.target.outputs.version }}
        run: node .github/scripts/release.mjs go-ready

  ci:
    name: ci
    needs: prepare
    uses: ./.github/workflows/ci.yml
    with:
      # With no pending publication, this remains ordinary CI on the triggering push.
      ref: ${{ needs.prepare.outputs.needed == 'true' && needs.prepare.outputs.sha || github.sha }}
      release-version: ${{ needs.prepare.outputs.needed == 'true' && needs.prepare.outputs.version || '' }}
    permissions:
      contents: read

  # Publish the exact artifact from full CI on the resolved release commit, using npm OIDC.
  # npm must trust this repository's release.yml workflow; no long-lived token is needed.
  npm:
    name: publish to npm
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: [prepare, ci]
    if: needs.prepare.outputs.needed == 'true'
    permissions:
      contents: read
      id-token: write # the OIDC token npm exchanges for a publish credential
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-packages
          path: /tmp/npm

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
          # Writes the .npmrc that points publish at the public registry. With trusted publishing
          # there is no token to put in it.
          registry-url: https://registry.npmjs.org

      # Use an npm version with trusted publishing support.
      - run: npm install -g npm@latest

      - name: verify tarball version and registry state
        id: artifact
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: node .github/scripts/release.mjs verify

      - name: publish the official package
        if: steps.artifact.outputs.needed == 'true'
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: node .github/scripts/release.mjs publish