github-actions/.github/workflows/publish.yml at main · DevExpress/github-actions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: Publish

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      message:
        type: string
        description: 'Overrides the publish commit subject. A publish is a snapshot, so when several commits piled up since the last run the newest subject alone undersells them.'
        required: false
        default: ''

permissions: {}

concurrency:
  group: publish

jobs:
  publish:
    name: Publish
    runs-on: ubuntu-slim
    environment: release-branch
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # GITHUB_TOKEN cannot create or update files under .github/workflows --
          # the `workflows` permission is not grantable to it. The release branch
          # carries repository-check.yml, so the push needs a PAT that has it.
          token: ${{ secrets.RELEASE_BRANCH_TOKEN }}

      - name: Setup PNPM
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: '.node-version'
          cache: 'pnpm'

      - name: Install Dependencies
        run: pnpm install --frozen-lockfile

      - name: Build and place publishable artifacts
        run: pnpm dist

      - name: Publish to release branch
        env:
          BRANCH: release
          SHA: ${{ github.sha }}
          MESSAGE: ${{ inputs.message }}
          GIT_USER_NAME: ${{ github.actor }}
          GIT_USER_EMAIL: ${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com
          WORKFLOW_FILES: repository-check.yml
          ACTION_DIRS: |
            get-changed-files
            pr-filter
            send-teams-notification
            validate-sbom
            verify-version-change
            install-internal-package
            lgtm
            validate-lock-files
            validate-node-versions
            pnpm-audit
          TAGS: |
            get-changed-files
            pr-filter
            send-teams-notification
            validate-sbom
            verify-version-change
            install-internal-package
            lgtm
            repository-check
        run: ./scripts/publish-actions.sh