|
| 1 | +name: Publish |
| 2 | + |
| 3 | +on: |
| 4 | + release: |
| 5 | + types: [published] |
| 6 | + |
| 7 | +permissions: |
| 8 | + contents: read |
| 9 | + |
| 10 | +concurrency: |
| 11 | + group: npm-publish |
| 12 | + cancel-in-progress: false |
| 13 | + |
| 14 | +jobs: |
| 15 | + publish: |
| 16 | + runs-on: ubuntu-latest |
| 17 | + timeout-minutes: 45 |
| 18 | + permissions: |
| 19 | + contents: read |
| 20 | + id-token: write |
| 21 | + steps: |
| 22 | + - uses: actions/checkout@v7 |
| 23 | + with: |
| 24 | + ref: ${{ github.event.release.tag_name }} |
| 25 | + persist-credentials: false |
| 26 | + - uses: actions/setup-node@v7 |
| 27 | + with: |
| 28 | + node-version-file: .node-version |
| 29 | + registry-url: https://registry.npmjs.org |
| 30 | + package-manager-cache: false |
| 31 | + - uses: pnpm/setup@v3 |
| 32 | + with: |
| 33 | + version: 12.3.4 |
| 34 | + - name: Install OIDC-capable npm |
| 35 | + run: npm install --global npm@11.21.0 --ignore-scripts |
| 36 | + - run: pnpm install --frozen-lockfile |
| 37 | + - name: Validate release version and channel |
| 38 | + id: release |
| 39 | + env: |
| 40 | + RELEASE_TAG: ${{ github.event.release.tag_name }} |
| 41 | + RELEASE_PRERELEASE: ${{ github.event.release.prerelease }} |
| 42 | + run: | |
| 43 | + node --input-type=module <<'NODE' |
| 44 | + import { appendFileSync } from 'node:fs'; |
| 45 | + import semver from 'semver'; |
| 46 | +
|
| 47 | + const version = semver.valid(process.env.RELEASE_TAG); |
| 48 | + if (!version || process.env.RELEASE_TAG.includes('+')) { |
| 49 | + throw new Error('Release tag must be SemVer without build metadata, optionally prefixed with v'); |
| 50 | + } |
| 51 | + const prerelease = semver.prerelease(version) !== null; |
| 52 | + if (String(prerelease) !== process.env.RELEASE_PRERELEASE) { |
| 53 | + throw new Error('Release prerelease flag must match the SemVer tag'); |
| 54 | + } |
| 55 | + appendFileSync(process.env.GITHUB_OUTPUT, `version=${version}\ntag=${prerelease ? 'next' : 'latest'}\n`); |
| 56 | + NODE |
| 57 | + - run: pnpm run check |
| 58 | + - name: Require deterministic generated files |
| 59 | + run: git diff --exit-code |
| 60 | + - name: Set plugin release version |
| 61 | + uses: TypescriptPrime/bump-packagejson-version@8b461d950090eae85d58d8a0085bfc993abdea0d # 1.1.9 |
| 62 | + with: |
| 63 | + package-json-dir-path: packages/oxlint-plugin |
| 64 | + - name: Set catalog release version |
| 65 | + uses: TypescriptPrime/bump-packagejson-version@8b461d950090eae85d58d8a0085bfc993abdea0d # 1.1.9 |
| 66 | + with: |
| 67 | + package-json-dir-path: packages/rule-catalog |
| 68 | + - name: Set config release version |
| 69 | + uses: TypescriptPrime/bump-packagejson-version@8b461d950090eae85d58d8a0085bfc993abdea0d # 1.1.9 |
| 70 | + with: |
| 71 | + package-json-dir-path: packages/oxlint-config |
| 72 | + - name: Build and test release packages |
| 73 | + run: | |
| 74 | + pnpm run build |
| 75 | + pnpm exec vitest run tests/consumer.test.ts |
| 76 | + - name: Pack and validate all release artifacts |
| 77 | + id: pack |
| 78 | + env: |
| 79 | + RELEASE_VERSION: ${{ steps.release.outputs.version }} |
| 80 | + DIST_TAG: ${{ steps.release.outputs.tag }} |
| 81 | + run: | |
| 82 | + node --input-type=module <<'NODE' |
| 83 | + import assert from 'node:assert/strict'; |
| 84 | + import { execFileSync } from 'node:child_process'; |
| 85 | + import { appendFileSync, mkdirSync, mkdtempSync, readdirSync } from 'node:fs'; |
| 86 | + import { join, resolve } from 'node:path'; |
| 87 | +
|
| 88 | + const directory = mkdtempSync(join(process.env.RUNNER_TEMP, 'ag-publish-')); |
| 89 | + const version = process.env.RELEASE_VERSION; |
| 90 | + for (const name of ['oxlint-plugin', 'rule-catalog', 'oxlint-config']) { |
| 91 | + const destination = join(directory, name); |
| 92 | + mkdirSync(destination); |
| 93 | + execFileSync('pnpm', ['pack', '--pack-destination', destination], { |
| 94 | + cwd: resolve('packages', name), stdio: 'inherit', |
| 95 | + }); |
| 96 | + const archives = readdirSync(destination).filter((file) => file.endsWith('.tgz')); |
| 97 | + assert.equal(archives.length, 1, `Expected one archive for ${name}`); |
| 98 | + const archive = join(destination, archives[0]); |
| 99 | + const manifest = JSON.parse(execFileSync('tar', ['-xOf', archive, 'package/package.json'], { |
| 100 | + encoding: 'utf8', |
| 101 | + })); |
| 102 | + assert.equal(manifest.name, `@agcodeguidelines/${name}`); |
| 103 | + assert.equal(manifest.version, version); |
| 104 | + assert.notEqual(manifest.private, true); |
| 105 | + assert.equal(manifest.repository.type, 'git'); |
| 106 | + assert.equal(manifest.repository.url, `git+https://github.com/${process.env.GITHUB_REPOSITORY}.git`); |
| 107 | + assert.equal(manifest.repository.directory, `packages/${name}`); |
| 108 | + for (const section of ['dependencies', 'optionalDependencies', 'peerDependencies']) { |
| 109 | + for (const range of Object.values(manifest[section] ?? {})) { |
| 110 | + assert.ok(!range.startsWith('workspace:'), `Unresolved workspace dependency in ${name}`); |
| 111 | + } |
| 112 | + } |
| 113 | + if (name === 'oxlint-config') { |
| 114 | + assert.equal(manifest.dependencies['@agcodeguidelines/oxlint-plugin'], version); |
| 115 | + } |
| 116 | + const files = execFileSync('tar', ['-tzf', archive], { encoding: 'utf8' }).split('\n'); |
| 117 | + for (const file of ['dist/index.js', 'dist/index.d.ts', 'LICENSE', 'README.md', 'THIRD_PARTY_NOTICES.md']) { |
| 118 | + assert.ok(files.includes(`package/${file}`), `Missing ${file} in ${name}`); |
| 119 | + } |
| 120 | + if (name === 'oxlint-config') { |
| 121 | + assert.ok(files.includes('package/tsconfig.base.json')); |
| 122 | + } |
| 123 | + execFileSync('npm', ['publish', archive, '--dry-run', '--access', 'public', '--tag', process.env.DIST_TAG], { |
| 124 | + stdio: 'inherit', |
| 125 | + }); |
| 126 | + } |
| 127 | + appendFileSync(process.env.GITHUB_OUTPUT, `directory=${directory}\n`); |
| 128 | + NODE |
| 129 | + - name: Reject already published versions |
| 130 | + env: |
| 131 | + RELEASE_VERSION: ${{ steps.release.outputs.version }} |
| 132 | + run: | |
| 133 | + node --input-type=module <<'NODE' |
| 134 | + import { spawnSync } from 'node:child_process'; |
| 135 | +
|
| 136 | + for (const name of ['oxlint-plugin', 'rule-catalog', 'oxlint-config']) { |
| 137 | + const result = spawnSync('npm', ['view', `@agcodeguidelines/${name}`, 'versions', '--json', |
| 138 | + '--registry=https://registry.npmjs.org'], { encoding: 'utf8' }); |
| 139 | + if (result.error) throw result.error; |
| 140 | + if (result.status !== 0) { |
| 141 | + const failure = JSON.parse(result.stdout || '{}'); |
| 142 | + if (result.status !== null && failure.error?.code === 'E404') continue; |
| 143 | + throw new Error(`Cannot check ${name}: ${result.stderr}`); |
| 144 | + } |
| 145 | + const versions = JSON.parse(result.stdout); |
| 146 | + const published = Array.isArray(versions) ? versions : [versions]; |
| 147 | + if (published.includes(process.env.RELEASE_VERSION)) { |
| 148 | + throw new Error(`${name}@${process.env.RELEASE_VERSION} already exists; inspect any partial release before retrying`); |
| 149 | + } |
| 150 | + } |
| 151 | + NODE |
| 152 | + - name: Publish with npm trusted publishing |
| 153 | + env: |
| 154 | + PACK_DIRECTORY: ${{ steps.pack.outputs.directory }} |
| 155 | + DIST_TAG: ${{ steps.release.outputs.tag }} |
| 156 | + run: | |
| 157 | + for package in oxlint-plugin rule-catalog oxlint-config; do |
| 158 | + archives=( "$PACK_DIRECTORY/$package/"*.tgz ) |
| 159 | + [[ ${#archives[@]} -eq 1 && -f "${archives[0]}" ]] |
| 160 | + npm publish "${archives[0]}" --access public --tag "$DIST_TAG" |
| 161 | + done |
0 commit comments