# Tag-driven release of a single package. # # git tag nopy-v1.2.0 && git push origin nopy-v1.2.0 # git tag keyman-v1.2.0 && git push origin keyman-v1.2.0 # # The tag is the source of truth for *which* package ships; package.json is the # source of truth for the version, and the two must agree or the run fails. # A version with a prerelease part (1.2.0-rc.1) publishes under `next` instead # of `latest`. # # Required secrets: # NPM_TOKEN npmjs granular token, read-and-write on @bitstack/*, 2FA # not required. Expires after 90 days — rotate it. # MYGITEA_NPM_TOKEN Gitea PAT with write:package. The automatic GITEA_TOKEN is # a repo-scoped task token and the package registry rejects it. name: Release on: push: tags: - '*-v*' concurrency: group: release-${{ github.ref }} cancel-in-progress: false jobs: release: if: contains(github.event.head_commit.message, '[release]') runs-on: ubuntu-latest env: GITEA_REGISTRY: ${{ github.server_url }}/api/packages/${{ github.repository_owner }}/npm/ GITEA_REGISTRY_TOKEN: ${{ secrets.MYGITEA_NPM_TOKEN || secrets.GITEA_TOKEN }} NPMJS_REGISTRY: https://registry.npmjs.org/ NPMJS_TOKEN: ${{ secrets.NPM_TOKEN }} NPMRC: ${{ github.workspace }}/.npmrc-release steps: - name: Check out uses: actions/checkout@v4 - name: Resolve the release from the tag id: target run: | set -euo pipefail tag="${GITHUB_REF#refs/tags/}" pkg="${tag%-v*}" version="${tag##*-v}" dir="packages/${pkg}" if [ ! -f "${dir}/package.json" ]; then echo "::error::Tag '${tag}' names package '${pkg}', but ${dir}/package.json does not exist." exit 1 fi declared=$(node -p "require('./${dir}/package.json').version") if [ "$declared" != "$version" ]; then echo "::error::Tag '${tag}' asks for ${version}, but ${dir}/package.json declares ${declared}. Bump the manifest and re-tag." exit 1 fi name=$(node -p "require('./${dir}/package.json').name") case "$version" in *-*) dist_tag=next ;; *) dist_tag=latest ;; esac { echo "tag=${tag}" echo "dir=${dir}" echo "name=${name}" echo "version=${version}" echo "dist_tag=${dist_tag}" } >> "$GITHUB_OUTPUT" echo "Releasing ${name}@${version} from ${dir} as '${dist_tag}'." - name: Check the required secrets are present run: | set -euo pipefail missing=0 [ -n "${NPMJS_TOKEN}" ] || { echo "::error::NPM_TOKEN secret is not set."; missing=1; } [ -n "${GITEA_REGISTRY_TOKEN}" ] || { echo "::error::No Gitea registry token available."; missing=1; } exit "$missing" - name: Set up pnpm # Version comes from `packageManager` in the root package.json. uses: pnpm/action-setup@v4 - name: Set up Node uses: actions/setup-node@v4 with: node-version-file: .nvmrc - name: Locate the pnpm store id: pnpm-store run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT" - name: Restore the pnpm store continue-on-error: true uses: actions/cache@v4 with: path: ${{ steps.pnpm-store.outputs.path }} key: pnpm-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }} restore-keys: pnpm-${{ runner.os }}- - name: Install run: pnpm install --frozen-lockfile - name: Lint run: pnpm run lint:ci - name: Typecheck run: pnpm run typecheck - name: Test with coverage run: pnpm run test:coverage - name: Build # Explicit, so the publish steps can skip lifecycle scripts entirely. run: pnpm run build - name: Publish to the Gitea registry env: NAME: ${{ steps.target.outputs.name }} VERSION: ${{ steps.target.outputs.version }} DIST_TAG: ${{ steps.target.outputs.dist_tag }} DIR: ${{ steps.target.outputs.dir }} run: | set -euo pipefail install -m 600 /dev/null "$NPMRC" { printf '@bitstack:registry=%s\n' "$GITEA_REGISTRY" printf '//%s:_authToken=%s\n' "${GITEA_REGISTRY#*://}" "$GITEA_REGISTRY_TOKEN" } >> "$NPMRC" export npm_config_userconfig="$NPMRC" if npm view "${NAME}@${VERSION}" version --registry "$GITEA_REGISTRY" >/dev/null 2>&1; then echo "${NAME}@${VERSION} is already on Gitea — skipping." else (cd "$DIR" && npm publish --ignore-scripts --tag "$DIST_TAG" --registry "$GITEA_REGISTRY") fi - name: Publish to npmjs env: NAME: ${{ steps.target.outputs.name }} VERSION: ${{ steps.target.outputs.version }} DIST_TAG: ${{ steps.target.outputs.dist_tag }} DIR: ${{ steps.target.outputs.dir }} run: | set -euo pipefail install -m 600 /dev/null "$NPMRC" { printf '@bitstack:registry=%s\n' "$NPMJS_REGISTRY" printf '//%s:_authToken=%s\n' "${NPMJS_REGISTRY#*://}" "$NPMJS_TOKEN" } >> "$NPMRC" export npm_config_userconfig="$NPMRC" if npm view "${NAME}@${VERSION}" version --registry "$NPMJS_REGISTRY" >/dev/null 2>&1; then echo "${NAME}@${VERSION} is already on npmjs — skipping." else # No --provenance: that needs GitHub Actions OIDC, which Gitea has no # equivalent for. (cd "$DIR" && npm publish --ignore-scripts --tag "$DIST_TAG" --access public --registry "$NPMJS_REGISTRY") fi - name: Remove the registry credentials if: always() run: rm -f "$NPMRC" - name: Create the Gitea release env: GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} TAG: ${{ steps.target.outputs.tag }} NAME: ${{ steps.target.outputs.name }} VERSION: ${{ steps.target.outputs.version }} DIST_TAG: ${{ steps.target.outputs.dist_tag }} DIR: ${{ steps.target.outputs.dir }} run: | set -euo pipefail api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases" status=$(curl -sS -o /dev/null -w '%{http_code}' \ -H "Authorization: token ${GITEA_TOKEN}" "${api}/tags/${TAG}") if [ "$status" = "200" ]; then echo "A release for ${TAG} already exists — leaving it alone." exit 0 fi # The section of the hand-written changelog that names this version. notes="" if [ -f "${DIR}/CHANGELOG.md" ]; then notes=$(awk -v v="$VERSION" ' /^## / { if (found) exit; if (index($0, v)) { found = 1; next } } found { print } ' "${DIR}/CHANGELOG.md") fi export NOTES="$notes" node -e ' const { NAME, VERSION, TAG, DIST_TAG, NOTES } = process.env; const install = DIST_TAG === "latest" ? `npm install -g ${NAME}` : `npm install -g ${NAME}@${VERSION}`; const body = [ NOTES.trim(), "", "```sh", install, "```", ].join("\n").trim(); console.log(JSON.stringify({ tag_name: TAG, name: `${NAME} v${VERSION}`, body, draft: false, prerelease: DIST_TAG !== "latest", })); ' > release.json curl -sS -f -X POST \ -H "Authorization: token ${GITEA_TOKEN}" \ -H "Content-Type: application/json" \ --data-binary @release.json \ "$api" rm -f release.json - name: Summarise # Reporting only; never the reason a green release goes red. continue-on-error: true env: NAME: ${{ steps.target.outputs.name }} VERSION: ${{ steps.target.outputs.version }} DIST_TAG: ${{ steps.target.outputs.dist_tag }} run: | set -euo pipefail : "${GITHUB_STEP_SUMMARY:=/dev/null}" { echo "### Released \`${NAME}@${VERSION}\` (\`${DIST_TAG}\`)" echo "" echo "- npmjs: \`npm install -g ${NAME}@${VERSION}\`" echo "- Gitea: \`npm install -g ${NAME}@${VERSION} --registry ${GITEA_REGISTRY}\`" } >> "$GITHUB_STEP_SUMMARY"