skillx/.github/workflows/release-cli.yml at main · nextlevelbuilder/skillx · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
name: Release CLI

on:
  push:
    branches: [main]

permissions:
  contents: write
  pull-requests: write

jobs:
  release-please:
    runs-on: ubuntu-latest
    outputs:
      release_created: ${{ steps.release.outputs['packages/cli--release_created'] }}
      tag_name: ${{ steps.release.outputs['packages/cli--tag_name'] }}
      version: ${{ steps.release.outputs['packages/cli--version'] }}
    steps:
      - uses: googleapis/release-please-action@v4
        id: release
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  publish:
    needs: release-please
    if: needs.release-please.outputs.release_created == 'true'
    runs-on: ubuntu-latest
    # npm trusted publishing: the registry exchanges this job's OIDC token for
    # a short-lived publish credential, so no long-lived NPM_TOKEN is needed.
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org

      # Trusted publishing needs npm 11.5.1 or newer; Node 22 bundles npm 10.
      - name: Upgrade npm
        run: npm install -g npm@11

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build CLI
        run: pnpm --filter skillx-sh build

      # Never publish a bundle that cannot start (see #73): run the built binary first.
      - name: Run built CLI
        run: |
          node packages/cli/bin/skillx.js --version
          node packages/cli/bin/skillx.js --help > /dev/null
          node packages/cli/bin/skillx.js release publish --help > /dev/null

      - name: Test built CLI
        run: pnpm exec vitest run packages/cli/src/built-cli.test.ts

      # pnpm pack rewrites workspace: ranges; npm publish then authenticates
      # through OIDC and attaches provenance automatically.
      - name: Publish to NPM
        working-directory: packages/cli
        run: |
          pnpm pack --pack-destination "$RUNNER_TEMP"
          npm publish "$RUNNER_TEMP"/skillx-sh-*.tgz --access public