Benjamin Diedrichsen
325 lines
13 KiB
YAML
325 lines
13 KiB
YAML
# Tag-driven release of a single package.
|
|
#
|
|
# git tag nopy-v1.2.0 && git push origin nopy-v1.2.0
|
|
# git tag nopy-cubes-v1.2.0 && git push origin nopy-cubes-v1.2.0
|
|
# git tag keyman-v1.2.0 && git push origin keyman-v1.2.0
|
|
#
|
|
# The tag is the source of truth for *which* package ships; package.json is the
|
|
# source of truth for the version, and the two must agree or the run fails.
|
|
#
|
|
# Packages that link to each other release dependency-first — `nopy-cubes` before
|
|
# `nopy` — because the linked version is resolved at pack time. The run refuses
|
|
# to publish otherwise.
|
|
# A version with a prerelease part (1.2.0-rc.1) publishes under `next` instead
|
|
# of `latest`.
|
|
#
|
|
# Required secrets:
|
|
# NPM_TOKEN npmjs granular token, read-and-write on @bitsquare/*, 2FA
|
|
# not required. Expires after 90 days — rotate it.
|
|
# MYGITEA_NPM_TOKEN Gitea PAT with write:package. The automatic GITEA_TOKEN is
|
|
# a repo-scoped task token and the package registry rejects it.
|
|
|
|
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- '*-v*'
|
|
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
|
|
env:
|
|
GITEA_REGISTRY: ${{ github.server_url }}/api/packages/${{ github.repository_owner }}/npm/
|
|
GITEA_REGISTRY_TOKEN: ${{ secrets.MYGITEA_NPM_TOKEN || secrets.GITEA_TOKEN }}
|
|
NPMJS_REGISTRY: https://registry.npmjs.org/
|
|
NPMJS_TOKEN: ${{ secrets.NPM_TOKEN }}
|
|
NPMRC: ${{ github.workspace }}/.npmrc-release
|
|
|
|
steps:
|
|
- name: Check out
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Drop the repo's Gitea scope mapping
|
|
# The committed .npmrc points @bitsquare at Gitea so local work resolves
|
|
# snapshots. It must not survive into a publish job: it is a *project*
|
|
# config, which outranks both the userconfig the steps below write and a
|
|
# `--registry` flag, because `@scope:registry` is more specific than
|
|
# `registry`. Left in place, `pnpm publish --registry <npmjs>` uploads to
|
|
# Gitea and `npm view --registry <npmjs>` answers from Gitea — so the
|
|
# npmjs release silently publishes nowhere and then skips itself.
|
|
# Measured, not assumed. The checkout is disposable; each step below
|
|
# names its registry explicitly anyway.
|
|
run: rm -f .npmrc
|
|
|
|
- name: Resolve the release from the tag
|
|
id: target
|
|
run: |
|
|
set -euo pipefail
|
|
tag="${GITHUB_REF#refs/tags/}"
|
|
pkg="${tag%-v*}"
|
|
version="${tag##*-v}"
|
|
dir="packages/${pkg}"
|
|
|
|
if [ ! -f "${dir}/package.json" ]; then
|
|
echo "::error::Tag '${tag}' names package '${pkg}', but ${dir}/package.json does not exist."
|
|
exit 1
|
|
fi
|
|
|
|
declared=$(node -p "require('./${dir}/package.json').version")
|
|
if [ "$declared" != "$version" ]; then
|
|
echo "::error::Tag '${tag}' asks for ${version}, but ${dir}/package.json declares ${declared}. Bump the manifest and re-tag."
|
|
exit 1
|
|
fi
|
|
|
|
name=$(node -p "require('./${dir}/package.json').name")
|
|
case "$version" in
|
|
*-*) dist_tag=next ;;
|
|
*) dist_tag=latest ;;
|
|
esac
|
|
|
|
{
|
|
echo "tag=${tag}"
|
|
echo "dir=${dir}"
|
|
echo "name=${name}"
|
|
echo "version=${version}"
|
|
echo "dist_tag=${dist_tag}"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
echo "Releasing ${name}@${version} from ${dir} as '${dist_tag}'."
|
|
|
|
- name: Check the required secrets are present
|
|
run: |
|
|
set -euo pipefail
|
|
missing=0
|
|
[ -n "${NPMJS_TOKEN}" ] || { echo "::error::NPM_TOKEN secret is not set."; missing=1; }
|
|
[ -n "${GITEA_REGISTRY_TOKEN}" ] || { echo "::error::No Gitea registry token available."; missing=1; }
|
|
exit "$missing"
|
|
|
|
- name: Set up pnpm
|
|
# Version comes from `packageManager` in the root package.json.
|
|
uses: pnpm/action-setup@v4
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version-file: .nvmrc
|
|
|
|
- name: Locate the pnpm store
|
|
id: pnpm-store
|
|
run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Restore the pnpm store
|
|
continue-on-error: true
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: ${{ steps.pnpm-store.outputs.path }}
|
|
key: pnpm-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
|
|
restore-keys: pnpm-${{ runner.os }}-
|
|
|
|
- name: Install
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Check the linked workspace packages are already released
|
|
env:
|
|
NAME: ${{ steps.target.outputs.name }}
|
|
DIR: ${{ steps.target.outputs.dir }}
|
|
run: |
|
|
set -euo pipefail
|
|
# `pnpm publish` turns `workspace:*` into the version the linked
|
|
# package declares at this commit. If that version is not on the
|
|
# registry yet, the release installs to a broken tree — and npmjs
|
|
# only lets you unpublish for 72 hours. Release the dependency first:
|
|
# nopy-cubes, then nopy, then any bundle.
|
|
#
|
|
# npmjs only: it is the irreversible one, and it needs no credentials
|
|
# to read, which this step does not have yet.
|
|
missing=0
|
|
for spec in $(node scripts/linked-deps.mjs "$DIR" | tr ' ' '@'); do
|
|
# Scoped, not `--registry`: `@scope:registry` outranks it, so a bare
|
|
# flag can be silently overridden by any project-level .npmrc.
|
|
if npm view "$spec" version --@bitsquare:registry="$NPMJS_REGISTRY" >/dev/null 2>&1; then
|
|
echo "${spec} is published"
|
|
else
|
|
echo "::error::${NAME} depends on ${spec}, which is not on npmjs. Release it first."
|
|
missing=1
|
|
fi
|
|
done
|
|
exit "$missing"
|
|
|
|
- name: Lint
|
|
run: pnpm run lint:ci
|
|
|
|
- name: Typecheck
|
|
run: pnpm run typecheck
|
|
|
|
- name: Test with coverage
|
|
run: pnpm run test:coverage
|
|
|
|
- name: Build
|
|
# Explicit, so the publish steps can skip lifecycle scripts entirely.
|
|
run: pnpm run build
|
|
|
|
- name: Stamp the commit into the manifest
|
|
# What `nopy --version` annotates itself with. The version is untouched:
|
|
# this only adds a `buildInfo.commit` key, which npm ignores and which
|
|
# ships regardless of `files` because package.json is always packed.
|
|
# Before the pack below, so the artefact under test is the one publish
|
|
# ships. The tree is left dirty, which is why both publish steps pass
|
|
# --no-git-checks — they already did, for the detached HEAD.
|
|
env:
|
|
DIR: ${{ steps.target.outputs.dir }}
|
|
run: |
|
|
set -euo pipefail
|
|
short_sha=$(git rev-parse --short=7 HEAD)
|
|
(cd "$DIR" && npm pkg set "buildInfo.commit=${short_sha}")
|
|
|
|
- name: Verify the packed manifests
|
|
# Packages link to each other with `workspace:*`, which npm cannot
|
|
# install. Proves on the tarball that pack rewrote it.
|
|
run: node scripts/verify-pack.mjs
|
|
|
|
- name: Publish to the Gitea registry
|
|
env:
|
|
NAME: ${{ steps.target.outputs.name }}
|
|
VERSION: ${{ steps.target.outputs.version }}
|
|
DIST_TAG: ${{ steps.target.outputs.dist_tag }}
|
|
DIR: ${{ steps.target.outputs.dir }}
|
|
run: |
|
|
set -euo pipefail
|
|
install -m 600 /dev/null "$NPMRC"
|
|
{
|
|
printf '@bitsquare:registry=%s\n' "$GITEA_REGISTRY"
|
|
printf '//%s:_authToken=%s\n' "${GITEA_REGISTRY#*://}" "$GITEA_REGISTRY_TOKEN"
|
|
} >> "$NPMRC"
|
|
export npm_config_userconfig="$NPMRC"
|
|
|
|
if npm view "${NAME}@${VERSION}" version --@bitsquare:registry="$GITEA_REGISTRY" >/dev/null 2>&1; then
|
|
echo "${NAME}@${VERSION} is already on Gitea — skipping."
|
|
else
|
|
# pnpm, not npm: npm ships `workspace:*` verbatim and the install
|
|
# then fails with EUNSUPPORTEDPROTOCOL. --no-git-checks because a
|
|
# tag build is a detached HEAD.
|
|
#
|
|
# The registry is named as `--@bitsquare:registry`, not `--registry`.
|
|
# Every package here is scoped, and for a scoped package npm resolves
|
|
# `@scope:registry` ahead of `registry` — so a bare flag loses to any
|
|
# project .npmrc that sets the scoped key.
|
|
(cd "$DIR" && pnpm publish --ignore-scripts --no-git-checks --tag "$DIST_TAG" --@bitsquare:registry="$GITEA_REGISTRY")
|
|
fi
|
|
|
|
- name: Publish to npmjs
|
|
env:
|
|
NAME: ${{ steps.target.outputs.name }}
|
|
VERSION: ${{ steps.target.outputs.version }}
|
|
DIST_TAG: ${{ steps.target.outputs.dist_tag }}
|
|
DIR: ${{ steps.target.outputs.dir }}
|
|
run: |
|
|
set -euo pipefail
|
|
install -m 600 /dev/null "$NPMRC"
|
|
{
|
|
printf '@bitsquare:registry=%s\n' "$NPMJS_REGISTRY"
|
|
printf '//%s:_authToken=%s\n' "${NPMJS_REGISTRY#*://}" "$NPMJS_TOKEN"
|
|
} >> "$NPMRC"
|
|
export npm_config_userconfig="$NPMRC"
|
|
|
|
if npm view "${NAME}@${VERSION}" version --@bitsquare:registry="$NPMJS_REGISTRY" >/dev/null 2>&1; then
|
|
echo "${NAME}@${VERSION} is already on npmjs — skipping."
|
|
else
|
|
# No --provenance: that needs GitHub Actions OIDC, which Gitea has no
|
|
# equivalent for.
|
|
#
|
|
# Scoped flag, as above — and it matters most here. With a bare
|
|
# `--registry` this line was measured uploading to Gitea whenever a
|
|
# project .npmrc mapped the scope, which is the one mistake npmjs
|
|
# will not let you take back.
|
|
(cd "$DIR" && pnpm publish --ignore-scripts --no-git-checks --tag "$DIST_TAG" --access public --@bitsquare:registry="$NPMJS_REGISTRY")
|
|
fi
|
|
|
|
- name: Remove the registry credentials
|
|
if: always()
|
|
run: rm -f "$NPMRC"
|
|
|
|
- name: Create the Gitea release
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
TAG: ${{ steps.target.outputs.tag }}
|
|
NAME: ${{ steps.target.outputs.name }}
|
|
VERSION: ${{ steps.target.outputs.version }}
|
|
DIST_TAG: ${{ steps.target.outputs.dist_tag }}
|
|
DIR: ${{ steps.target.outputs.dir }}
|
|
run: |
|
|
set -euo pipefail
|
|
api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases"
|
|
|
|
status=$(curl -sS -o /dev/null -w '%{http_code}' \
|
|
-H "Authorization: token ${GITEA_TOKEN}" "${api}/tags/${TAG}")
|
|
if [ "$status" = "200" ]; then
|
|
echo "A release for ${TAG} already exists — leaving it alone."
|
|
exit 0
|
|
fi
|
|
|
|
# The section of the hand-written changelog that names this version.
|
|
notes=""
|
|
if [ -f "${DIR}/CHANGELOG.md" ]; then
|
|
notes=$(awk -v v="$VERSION" '
|
|
/^## / { if (found) exit; if (index($0, v)) { found = 1; next } }
|
|
found { print }
|
|
' "${DIR}/CHANGELOG.md")
|
|
fi
|
|
export NOTES="$notes"
|
|
|
|
node -e '
|
|
const { NAME, VERSION, TAG, DIST_TAG, NOTES } = process.env;
|
|
const install =
|
|
DIST_TAG === "latest"
|
|
? `npm install -g ${NAME}`
|
|
: `npm install -g ${NAME}@${VERSION}`;
|
|
const body = [
|
|
NOTES.trim(),
|
|
"",
|
|
"```sh",
|
|
install,
|
|
"```",
|
|
].join("\n").trim();
|
|
console.log(JSON.stringify({
|
|
tag_name: TAG,
|
|
name: `${NAME} v${VERSION}`,
|
|
body,
|
|
draft: false,
|
|
prerelease: DIST_TAG !== "latest",
|
|
}));
|
|
' > release.json
|
|
|
|
curl -sS -f -X POST \
|
|
-H "Authorization: token ${GITEA_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
--data-binary @release.json \
|
|
"$api"
|
|
rm -f release.json
|
|
|
|
- name: Summarise
|
|
# Reporting only; never the reason a green release goes red.
|
|
continue-on-error: true
|
|
env:
|
|
NAME: ${{ steps.target.outputs.name }}
|
|
VERSION: ${{ steps.target.outputs.version }}
|
|
DIST_TAG: ${{ steps.target.outputs.dist_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
: "${GITHUB_STEP_SUMMARY:=/dev/null}"
|
|
{
|
|
echo "### Released \`${NAME}@${VERSION}\` (\`${DIST_TAG}\`)"
|
|
echo ""
|
|
echo "- npmjs: \`npm install -g ${NAME}@${VERSION}\`"
|
|
# Scoped, never a bare `--registry`: Gitea serves @bitsquare only and
|
|
# does not proxy npmjs, so a bare flag sends every transitive
|
|
# dependency to a registry that has never heard of them.
|
|
echo "- Gitea: \`npm install -g ${NAME}@${VERSION} --@bitsquare:registry=${GITEA_REGISTRY}\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|