ci: publish packages via nx release and npm trusted publishing

.github/workflows/publish.yml

@@ -0,0 +1,41 @@
+name: publish
+
+on:
+  push:
+    tags:
+      - cli-*.*.*
+      - nx-plugin-*.*.*
+  workflow_dispatch:
+
+concurrency:
+  group: publish
+  cancel-in-progress: false
+
+# configured as trusted publisher (OIDC)
+# https://docs.npmjs.com/trusted-publishers
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    name: Publish packages
+    # This line is critical for copy paste issues
+    if: github.repository == 'push-based/user-flow'
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - name: Clone the repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up Node.js
+        # trusted publishing requires npm >= 11.5.1, which ships with Node 24
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
+      - name: Publish packages to npm
+        run: npx nx release publish

.github/workflows/release.yml

@@ -6,43 +6,52 @@ on:
       - main
     paths-ignore:
       - '*.md'
+  workflow_dispatch:
+
+concurrency:
+  group: release
+  cancel-in-progress: false
 
 jobs:
   release:
+    name: Version and release
     # This line is critical for copy paste issues
     if: github.repository == 'push-based/user-flow'
-    timeout-minutes: 5
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [20.x]
-
+    environment: release
     steps:
-      - uses: actions/checkout@v4
+      - name: Authenticate as "PushBased Bot" GitHub App
+        uses: actions/create-github-app-token@v2
+        id: app-token
+        with:
+          app-id: ${{ vars.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+      - name: Fetch GitHub App's user ID
+        id: get-user-id
+        run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+      - name: Configure Git user
+        run: |
+          git config --global user.name '${{ steps.app-token.outputs.app-slug }}[bot]'
+          git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com'
+      - name: Clone the repository
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Setup git user to "push-based.io - bot"
-        shell: bash
-        run: git config user.email "opensource@push-based.io" && git config user.name "push-based.io - bot"
-      - name: use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+          token: ${{ steps.app-token.outputs.token }}
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
         with:
-          cache: 'npm'
-          node-version: ${{ matrix.node-version }}
-          registry-url: https://registry.npmjs.org
-      - name: install
+          node-version: 22
+          cache: npm
+      - name: Install dependencies
         run: npm ci
-      - name: build
-        run: npm run nx -- affected:build
-      - name: test
-        run: npm run nx -- affected:test
-      - name: release CLI
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npm run nx -- run cli:version
-      - name: release Nx plugin
+      - name: Build
+        run: npx nx run-many -t build
+      - name: Test
+        run: npx nx run-many -t test
+      - name: Version, release and generate changelog
+        run: npx nx release --skip-publish
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npm run nx -- run nx-plugin:version
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}

nx.json

@@ -57,6 +57,13 @@
         "{workspaceRoot}/eslint.config.mjs"
       ],
       "cache": true
+    },
+    "nx-release-publish": {
+      "dependsOn": ["build"],
+      "options": {
+        "registry": "https://registry.npmjs.org/",
+        "access": "public"
+      }
     }
   },
   "generators": {
@@ -72,5 +79,31 @@
   },
   "nxCloudAccessToken": "MDlmODg4OTQtYWVlZC00OGVkLTgyMjktMDc3OWQ5ZjU1ZTAxfHJlYWQtd3JpdGU=",
   "useInferencePlugins": false,
-  "defaultBase": "origin/main"
+  "defaultBase": "origin/main",
+  "release": {
+    "projects": ["cli", "nx-plugin"],
+    "projectsRelationship": "independent",
+    "releaseTagPattern": "{projectName}-{version}",
+    "changelog": {
+      "automaticFromRef": true,
+      "projectChangelogs": {
+        "createRelease": "github"
+      }
+    },
+    "git": {
+      "commit": true,
+      "commitMessage": "release: publish",
+      "commitArgs": "--no-verify",
+      "tag": true,
+      "push": true,
+      "pushRemote": "origin"
+    },
+    "version": {
+      "conventionalCommits": true,
+      "fallbackCurrentVersionResolver": "disk",
+      "versionActionsOptions": {
+        "skipLockFileUpdate": true
+      }
+    }
+  }
 }