Skip to content

Commit 195e06f

Browse files
waleedlatif1waleedlatif1
committed
Merge remote-tracking branch 'origin/staging' into wip/platform-org-wiring
2 parents 59a2fcb + c7f78aa commit 195e06f

17 files changed

Lines changed: 519 additions & 346 deletions

File tree

‎.github/actions/setup/action.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,6 @@ inputs:
1414
description: Node version to install. Empty keeps the runner's preinstalled Node, for jobs that only ever ran Bun.
1515
required: false
1616
default: '24'
17-
registry-url:
18-
description: npm registry to write an .npmrc for, so `npm publish` reads NODE_AUTH_TOKEN. Empty writes none.
19-
required: false
20-
default: ''
2117

2218
# Sticky disk keys are scoped by event name, and fork PRs get their own namespace on
2319
# top: untrusted fork runs must never share a cache with push runs (whose caches
@@ -43,7 +39,6 @@ runs:
4339
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
4440
with:
4541
node-version: ${{ inputs.node-version }}
46-
registry-url: ${{ inputs.registry-url }}
4742

4843
- name: Mount Bun cache
4944
if: inputs.provider == '' || inputs.provider == 'blacksmith'

‎.github/workflows/publish-cli.yml‎

Lines changed: 52 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,13 @@ concurrency:
1515
cancel-in-progress: false
1616

1717
jobs:
18-
publish:
19-
name: publish
18+
build:
19+
name: build
2020
runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
2121
timeout-minutes: 15
22+
outputs:
23+
version: ${{ steps.package_version.outputs.version }}
24+
exists: ${{ steps.version_check.outputs.exists }}
2225
steps:
2326
- name: Checkout repository
2427
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
@@ -30,7 +33,6 @@ jobs:
3033
with:
3134
provider: ${{ vars.CI_PROVIDER }}
3235
node-version: '22'
33-
registry-url: https://registry.npmjs.org/
3436

3537
- name: Build package
3638
working-directory: packages/cli
@@ -39,28 +41,67 @@ jobs:
3941
- name: Get package version
4042
id: package_version
4143
working-directory: packages/cli
42-
run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
44+
run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
4345

4446
- name: Check if version already exists
4547
id: version_check
4648
env:
4749
VERSION: ${{ steps.package_version.outputs.version }}
4850
run: |
4951
if npm view "simstudio@$VERSION" version &> /dev/null; then
50-
echo "exists=true" >> $GITHUB_OUTPUT
52+
echo "exists=true" >> "$GITHUB_OUTPUT"
5153
else
52-
echo "exists=false" >> $GITHUB_OUTPUT
54+
echo "exists=false" >> "$GITHUB_OUTPUT"
5355
fi
5456
55-
- name: Publish to npm
57+
# Bun packs because it rewrites `workspace:` ranges to real versions,
58+
# which `npm pack` would publish verbatim.
59+
- name: Pack package
5660
if: steps.version_check.outputs.exists == 'false'
5761
working-directory: packages/cli
58-
run: npm publish --access=public
59-
env:
60-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
62+
run: bun pm pack --ignore-scripts --filename "$RUNNER_TEMP/package.tgz" --quiet
63+
64+
- name: Upload package
65+
if: steps.version_check.outputs.exists == 'false'
66+
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
67+
with:
68+
name: package
69+
path: ${{ runner.temp }}/package.tgz
70+
if-no-files-found: error
71+
retention-days: 1
6172

6273
- name: Log skipped publish
6374
if: steps.version_check.outputs.exists == 'true'
6475
env:
6576
VERSION: ${{ steps.package_version.outputs.version }}
66-
run: echo "Skipped publishing because version $VERSION already exists on npm"
77+
run: echo "Skipped publishing because version $VERSION already exists on npm"
78+
79+
# npm trusted publishing trades this job's OIDC token for a short-lived npm
80+
# credential, so no npm token is stored anywhere. npm accepts the token only
81+
# from GitHub-hosted runners, and only this job can mint one: it runs no
82+
# repository code, it publishes the tarball the build job packed. npm runs no
83+
# lifecycle scripts for a tarball, so nothing is rebuilt here, and provenance
84+
# is attached automatically.
85+
publish:
86+
name: publish
87+
needs: build
88+
if: needs.build.outputs.exists == 'false'
89+
runs-on: ubuntu-latest
90+
timeout-minutes: 10
91+
permissions:
92+
id-token: write
93+
steps:
94+
# Node 24 bundles npm 11.5.1+, which trusted publishing requires.
95+
- name: Setup Node
96+
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
97+
with:
98+
node-version: '24'
99+
100+
- name: Download package
101+
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
102+
with:
103+
name: package
104+
path: ${{ runner.temp }}
105+
106+
- name: Publish to npm
107+
run: npm publish "$RUNNER_TEMP/package.tgz" --access public

‎.github/workflows/publish-sim-cli.yml‎

Lines changed: 58 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,13 @@ concurrency:
1919
cancel-in-progress: false
2020

2121
jobs:
22-
publish:
23-
name: publish
22+
build:
23+
name: build
2424
runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
2525
timeout-minutes: 15
26+
outputs:
27+
version: ${{ steps.release.outputs.version }}
28+
tag: ${{ steps.release.outputs.tag }}
2629
steps:
2730
- name: Checkout repository
2831
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
@@ -37,11 +40,6 @@ jobs:
3740
provider: ${{ vars.CI_PROVIDER }}
3841
node-version: '22'
3942

40-
- name: Verify npm authentication
41-
env:
42-
NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
43-
run: bun pm whoami
44-
4543
- name: Auto-bump package version
4644
run: bun run bump:npm-packages sim-cli
4745

@@ -54,9 +52,10 @@ jobs:
5452
run: bun run type-check
5553

5654
# The usage-reporting destination is baked into the bundle at build time
57-
# (docs/cli/usage-data), so only the two steps that build it get the
58-
# token. Every other step, the tests above in particular, runs without
59-
# it: a test that runs a real command must never report to production.
55+
# (docs/cli/usage-data), so only this step gets the token, and the
56+
# tarball packed from its output is what ships. Every other step, the
57+
# tests above in particular, runs without it: a test that runs a real
58+
# command must never report to production.
6059
- name: Build package
6160
working-directory: packages/sim-cli
6261
env:
@@ -107,23 +106,28 @@ jobs:
107106
echo "tag=$TAG"
108107
} >> "$GITHUB_OUTPUT"
109108
109+
# Bun packs because it rewrites `workspace:` ranges to real versions,
110+
# which `npm pack` would publish verbatim. The smoke test below and the
111+
# publish job both use this one tarball, so what was tested is what ships.
112+
- name: Pack package
113+
working-directory: packages/sim-cli
114+
run: bun pm pack --ignore-scripts --filename "$RUNNER_TEMP/package.tgz" --quiet
115+
110116
- name: Setup Node 20 for the bundle smoke test
111117
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
112118
with:
113119
node-version: '20'
114120

115121
- name: Smoke-test packed Node bundle
116-
working-directory: packages/sim-cli
122+
env:
123+
VERSION: ${{ steps.release.outputs.version }}
117124
run: |
118125
set -euo pipefail
119126
SMOKE_DIR="$(mktemp -d "$RUNNER_TEMP/sim-cli-smoke.XXXXXX")"
120-
PACKAGE_PATH="$SMOKE_DIR/sim-cli.tgz"
121-
bun pm pack --ignore-scripts --filename "$PACKAGE_PATH" --quiet
122-
tar -xzf "$PACKAGE_PATH" -C "$SMOKE_DIR"
123-
"$SMOKE_DIR/package/dist/index.js" --version
127+
tar -xzf "$RUNNER_TEMP/package.tgz" -C "$SMOKE_DIR"
128+
test "$("$SMOKE_DIR/package/dist/index.js" --version)" = "$VERSION"
124129
125130
- name: Verify version is unpublished
126-
working-directory: packages/sim-cli
127131
env:
128132
VERSION: ${{ steps.release.outputs.version }}
129133
run: |
@@ -132,19 +136,47 @@ jobs:
132136
exit 1
133137
fi
134138
135-
# `bun publish` runs `prepublishOnly`, which rebuilds `dist`, and that
136-
# rebuild is what ships, so it needs the token as well.
139+
- name: Upload package
140+
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
141+
with:
142+
name: package
143+
path: ${{ runner.temp }}/package.tgz
144+
if-no-files-found: error
145+
retention-days: 1
146+
147+
# npm trusted publishing trades this job's OIDC token for a short-lived npm
148+
# credential, so no npm token is stored anywhere. npm accepts the token only
149+
# from GitHub-hosted runners, and only this job can mint one: it runs no
150+
# repository code, it publishes the tarball the build job tested. npm runs no
151+
# lifecycle scripts for a tarball, so nothing is rebuilt here, and provenance
152+
# is attached automatically.
153+
publish:
154+
name: publish
155+
needs: build
156+
runs-on: ubuntu-latest
157+
timeout-minutes: 10
158+
permissions:
159+
id-token: write
160+
steps:
161+
# Node 24 bundles npm 11.5.1+, which trusted publishing requires.
162+
- name: Setup Node
163+
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
164+
with:
165+
node-version: '24'
166+
167+
- name: Download package
168+
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
169+
with:
170+
name: package
171+
path: ${{ runner.temp }}
172+
137173
- name: Publish to npm
138-
working-directory: packages/sim-cli
139174
env:
140-
NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
141-
NPM_TAG: ${{ steps.release.outputs.tag }}
142-
SIM_CLI_TELEMETRY_KEY: ${{ vars.SIM_CLI_TELEMETRY_KEY }}
143-
SIM_CLI_TELEMETRY_HOST: ${{ vars.SIM_CLI_TELEMETRY_HOST }}
144-
run: bun publish --access public --tag "$NPM_TAG" --no-save
175+
NPM_TAG: ${{ needs.build.outputs.tag }}
176+
run: npm publish "$RUNNER_TEMP/package.tgz" --access public --tag "$NPM_TAG"
145177

146178
- name: Summarize release
147179
env:
148-
VERSION: ${{ steps.release.outputs.version }}
149-
NPM_TAG: ${{ steps.release.outputs.tag }}
180+
VERSION: ${{ needs.build.outputs.version }}
181+
NPM_TAG: ${{ needs.build.outputs.tag }}
150182
run: echo "Published sim@$VERSION with the '$NPM_TAG' tag."

‎.github/workflows/publish-sim-setup.yml‎

Lines changed: 57 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ on:
1010
- 'packages/utils/**'
1111
- 'docker-compose.prod.yml'
1212
- 'bun.lock'
13+
# A change to how the package is built or published has to republish it.
14+
- '.github/workflows/publish-sim-setup.yml'
1315

1416
permissions:
1517
contents: read
@@ -19,10 +21,13 @@ concurrency:
1921
cancel-in-progress: false
2022

2123
jobs:
22-
publish:
23-
name: publish
24+
build:
25+
name: build
2426
runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
2527
timeout-minutes: 15
28+
outputs:
29+
version: ${{ steps.release.outputs.version }}
30+
tag: ${{ steps.release.outputs.tag }}
2631
steps:
2732
- name: Checkout repository
2833
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
@@ -37,11 +42,6 @@ jobs:
3742
provider: ${{ vars.CI_PROVIDER }}
3843
node-version: '22'
3944

40-
- name: Verify npm authentication
41-
env:
42-
NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
43-
run: bun pm whoami
44-
4545
- name: Auto-bump package version
4646
run: bun run bump:npm-packages sim-setup
4747

@@ -104,21 +104,27 @@ jobs:
104104
echo "tag=$TAG"
105105
} >> "$GITHUB_OUTPUT"
106106
107+
# Bun packs because it rewrites `workspace:` ranges to real versions,
108+
# which `npm pack` would publish verbatim. The smoke test below and the
109+
# publish job both use this one tarball, so what was tested is what ships.
110+
- name: Pack package
111+
working-directory: packages/sim-setup
112+
run: bun pm pack --ignore-scripts --filename "$RUNNER_TEMP/package.tgz" --quiet
113+
107114
- name: Setup Node 20 for the bundle smoke test
108115
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
109116
with:
110117
node-version: '20'
111118

112119
- name: Smoke-test packed Node bundle
113-
working-directory: packages/sim-setup
120+
env:
121+
VERSION: ${{ steps.release.outputs.version }}
114122
run: |
115123
set -euo pipefail
116124
SMOKE_DIR="$(mktemp -d "$RUNNER_TEMP/sim-setup-smoke.XXXXXX")"
117-
PACKAGE_PATH="$SMOKE_DIR/sim-setup.tgz"
118-
bun pm pack --ignore-scripts --filename "$PACKAGE_PATH" --quiet
119-
tar -xzf "$PACKAGE_PATH" -C "$SMOKE_DIR"
125+
tar -xzf "$RUNNER_TEMP/package.tgz" -C "$SMOKE_DIR"
120126
121-
if tar -tzf "$PACKAGE_PATH" | grep -Eq '^package/(apps|docker|helm|packages|scripts)/'; then
127+
if tar -tzf "$RUNNER_TEMP/package.tgz" | grep -Eq '^package/(apps|docker|helm|packages|scripts)/'; then
122128
echo 'Packed setup package contains repository source directories.' >&2
123129
exit 1
124130
fi
@@ -130,7 +136,7 @@ jobs:
130136
fi
131137
132138
cd "$SMOKE_DIR"
133-
node package/dist/index.js --version
139+
test "$(node package/dist/index.js --version)" = "$VERSION"
134140
node package/dist/index.js --help
135141
for command in config add doctor start stop restart update status logs down reset; do
136142
node package/dist/index.js "$command" --help > /dev/null
@@ -146,7 +152,6 @@ jobs:
146152
fi
147153
148154
- name: Verify version is unpublished
149-
working-directory: packages/sim-setup
150155
env:
151156
VERSION: ${{ steps.release.outputs.version }}
152157
run: |
@@ -155,15 +160,47 @@ jobs:
155160
exit 1
156161
fi
157162
163+
- name: Upload package
164+
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
165+
with:
166+
name: package
167+
path: ${{ runner.temp }}/package.tgz
168+
if-no-files-found: error
169+
retention-days: 1
170+
171+
# npm trusted publishing trades this job's OIDC token for a short-lived npm
172+
# credential, so no npm token is stored anywhere. npm accepts the token only
173+
# from GitHub-hosted runners, and only this job can mint one: it runs no
174+
# repository code, it publishes the tarball the build job tested. npm runs no
175+
# lifecycle scripts for a tarball, so nothing is rebuilt here, and provenance
176+
# is attached automatically.
177+
publish:
178+
name: publish
179+
needs: build
180+
runs-on: ubuntu-latest
181+
timeout-minutes: 10
182+
permissions:
183+
id-token: write
184+
steps:
185+
# Node 24 bundles npm 11.5.1+, which trusted publishing requires.
186+
- name: Setup Node
187+
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
188+
with:
189+
node-version: '24'
190+
191+
- name: Download package
192+
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
193+
with:
194+
name: package
195+
path: ${{ runner.temp }}
196+
158197
- name: Publish to npm
159-
working-directory: packages/sim-setup
160198
env:
161-
NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
162-
NPM_TAG: ${{ steps.release.outputs.tag }}
163-
run: bun publish --access public --tag "$NPM_TAG" --no-save
199+
NPM_TAG: ${{ needs.build.outputs.tag }}
200+
run: npm publish "$RUNNER_TEMP/package.tgz" --access public --tag "$NPM_TAG"
164201

165202
- name: Summarize release
166203
env:
167-
VERSION: ${{ steps.release.outputs.version }}
168-
NPM_TAG: ${{ steps.release.outputs.tag }}
204+
VERSION: ${{ needs.build.outputs.version }}
205+
NPM_TAG: ${{ needs.build.outputs.tag }}
169206
run: echo "Published sim-setup@$VERSION with the '$NPM_TAG' tag."

0 commit comments

Comments
 (0)