codemap/.github/workflows/release.yml at main · stainless-code/codemap · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
# [Changesets](https://github.com/changesets/changesets): open a "Version packages" PR when
# `.changeset/*.md` files land on `main`, then publish to npm when that PR merges via npm
# trusted publishing (GitHub OIDC — no NPM_TOKEN; provenance auto-generated).
name: Release

on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: write
  pull-requests: write
  id-token: write

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    environment: release
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0

      # npm trusted publishing (OIDC) needs npm ≥ 11.5.1 + Node ≥ 22.14
      # (docs.npmjs.com/trusted-publishers). setup-bun leaves the runner's
      # npm 10.x in PATH → `npm publish` can't detect OIDC → ENEEDAUTH.
      # Node 24 ships npm 11.x; npm then auto-authenticates via OIDC (no token).
      #
      # MUST run before `bun install`: better-sqlite3's native addon is built
      # by node-gyp against whichever `node` is in PATH. If install runs under
      # the runner's default Node and we then switch to Node 24, the
      # `worker-pool.dist.test.ts` smoke test spawns `node dist/index.mjs --full`
      # under Node 24 and hits ERR_DLOPEN_FAILED (NODE_MODULE_VERSION mismatch)
      # → prepublishOnly fails → publish fails. Putting Node 24 in PATH first
      # makes node-gyp compile against ABI 137 so the test passes.
      - name: Setup Node + npm for trusted publishing
        uses: actions/setup-node@v6
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Setup Bun and install
        uses: ./.github/actions/setup

      # Opens/updates the Version PR when `.changeset/*.md` exist. When there are none, the action
      # can still run `publish` (see changesets/action) so a just-merged Version PR can ship.
      # `changeset publish` should exit 0 when there is nothing new to publish. If this job fails,
      # read the step log: common causes are OIDC/trusted-publishing misconfig (`id-token: write`,
      # the `release` environment, or the npm trusted-publisher binding), registry/network errors,
      # or a real publish failure — not assumed from the runner alone.
      - name: Create Release Pull Request or Publish to npm
        id: changesets
        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1
        with:
          # Runs `changeset version` then oxfmt on CHANGELOG.md so `format:check` passes (see docs/packaging.md).
          version: bun run version
          publish: bun run release
          title: "chore: version packages"
          commit: "chore: version packages"
          createGithubReleases: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}