Skip to content

Commit 2174c9d

Browse files
jonrohanjonrohan
authored
Release npm trusted providers (#1268)
* Update release to trusted providers and combine into 1 workflow * Add upload versions action * Add permissions * Update npm version * remove continue * Update node version
1 parent 3182eaa commit 2174c9d

File tree

4 files changed

+150
-197
lines changed

4 files changed

+150
-197
lines changed

‎.github/actions/upload-versions/action.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: 'Upload Versions'
2+
description: 'Upload version information for public packages'
3+
runs:
4+
using: 'composite'
5+
steps:
6+
- name: Set up Node
7+
uses: actions/setup-node@v6
8+
with:
9+
node-version: 24
10+
cache: 'npm'
11+
12+
- name: Write workspace versions as JSON file
13+
uses: actions/github-script@a3e7071a34d7e1f219a8a4de9a5e0a34d1ee1293
14+
with:
15+
script: |
16+
const fs = require('node:fs');
17+
18+
const output = {
19+
packages: [],
20+
};
21+
22+
const contents = fs.readFileSync('./package.json', 'utf8');
23+
const packageJson = JSON.parse(contents);
24+
25+
const pkg = {
26+
name: packageJson.name,
27+
version: packageJson.version,
28+
};
29+
output.packages.push(pkg);
30+
31+
fs.writeFileSync('versions.json', JSON.stringify(output, null, 2));
32+
- name: Upload version file
33+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
34+
with:
35+
name: versions
36+
path: versions.json

‎.github/workflows/release.yml‎

Lines changed: 114 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,20 @@
11
name: Release
22
on:
33
push:
4-
branches:
5-
- 'main'
6-
- 'next-major'
4+
5+
concurrency:
6+
group: ${{ github.workflow }}-${{ github.ref }}
7+
cancel-in-progress: true
8+
9+
permissions:
10+
id-token: write # Required for OIDC
11+
contents: read
12+
checks: write
13+
statuses: write
14+
715
jobs:
8-
release_candidate:
9-
name: Release for latest version
16+
release:
17+
name: Main
1018
if: ${{ github.repository == 'primer/primitives' && github.ref_name == 'main' }}
1119

1220
runs-on: ubuntu-latest
@@ -18,10 +26,10 @@ jobs:
1826
fetch-depth: 0
1927
persist-credentials: false
2028

21-
- name: Set up Node.js
22-
uses: actions/setup-node@v4
29+
- name: Set up Node
30+
uses: actions/setup-node@v6
2331
with:
24-
node-version: 22
32+
node-version: 24
2533
cache: 'npm'
2634

2735
- name: Install dependencies
@@ -46,7 +54,6 @@ jobs:
4654
publish: npm run release
4755
env:
4856
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
49-
NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN_SHARED }}
5057

5158
- name: Output release version to summary
5259
if: ${{ steps.changesets.outputs.published}} = 'true'
@@ -57,9 +64,9 @@ jobs:
5764
echo "### Latest release" >> $GITHUB_STEP_SUMMARY
5865
echo "[v$VERSION](https://unpkg.com/$PACKAGE_NAME@$VERSION/)" >> $GITHUB_STEP_SUMMARY
5966
60-
release_candidate_next_major:
61-
name: Release for next version
62-
if: ${{ github.repository == 'primer/primitives' && github.ref_name == 'next-major' }}
67+
release-candidate:
68+
name: Candidate
69+
if: ${{ github.repository == 'primer/primitives' && github.ref_name == 'changeset-release/main' }}
6370

6471
runs-on: ubuntu-latest
6572
steps:
@@ -68,43 +75,114 @@ jobs:
6875
with:
6976
# This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
7077
fetch-depth: 0
71-
persist-credentials: false
7278

73-
- name: Set up Node.js
74-
uses: actions/setup-node@v4
79+
- name: Set up Node
80+
uses: actions/setup-node@v6
7581
with:
76-
node-version: 22
82+
node-version: 24
7783
cache: 'npm'
7884

7985
- name: Install dependencies
80-
run: npm ci --no-audit --no-fund && pushd docs; npm ci --no-audit --no-fund; popd
86+
run: npm ci --no-audit --no-fund --include=dev
8187

8288
- name: Build tokens
83-
run: npm run build
89+
run: npm run build:tokens
8490

85-
- uses: actions/create-github-app-token@v1
86-
id: app-token
91+
- name: Publish release candidate
92+
run: |
93+
version=$(jq -r .version package.json)
94+
echo "$( jq ".version = \"$(echo $version)-rc.$(git rev-parse --short HEAD)\"" package.json )" > package.json
95+
npm publish --tag next
96+
env:
97+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
98+
99+
- name: Output candidate version number
100+
id: commitStatus
101+
uses: actions/github-script@v7
87102
with:
88-
app-id: ${{ vars.PRIMER_APP_ID_SHARED }}
89-
private-key: ${{ secrets.PRIMER_APP_PRIVATE_KEY_SHARED }}
103+
script: |
104+
const package = require(`${process.env.GITHUB_WORKSPACE}/package.json`)
105+
github.rest.repos.createCommitStatus({
106+
owner: context.repo.owner,
107+
repo: context.repo.repo,
108+
sha: context.sha,
109+
state: 'success',
110+
context: `Published ${package.name}`,
111+
description: package.version,
112+
target_url: `https://unpkg.com/${package.name}@${package.version}/`
113+
})
114+
// Output the release version for next step
115+
core.setOutput('packageVersion', package.version);
116+
// Output the package name for next step
117+
core.setOutput('packageName', package.name);
90118
91-
- name: Create release pull request or publish to npm
92-
id: changesets
93-
uses: changesets/[email protected]
94-
continue-on-error: true
119+
- name: Output candidate version to summary
120+
env:
121+
VERSION: ${{ steps.commitStatus.outputs.packageVersion }}
122+
PACKAGE_NAME: ${{ steps.commitStatus.outputs.packageName }}
123+
run: |
124+
echo "### Latest release candidate" >> $GITHUB_STEP_SUMMARY
125+
echo "[v$VERSION](https://unpkg.com/$PACKAGE_NAME@$VERSION/)" >> $GITHUB_STEP_SUMMARY
126+
- uses: ./.github/actions/upload-versions
127+
128+
release-canary:
129+
name: Canary
130+
if: ${{ github.repository == 'primer/primitives' && github.ref_name != 'main' && github.ref_name != 'changeset-release/main' }}
131+
132+
runs-on: ubuntu-latest
133+
steps:
134+
- name: Checkout repository
135+
uses: actions/checkout@v4
95136
with:
96-
title: Release Tracking (Next Major)
97-
# This expects you to have a script called release which does a build for your packages and calls changeset publish
98-
publish: npx changeset publish --tag next
137+
# This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
138+
fetch-depth: 0
139+
140+
- name: Set up Node
141+
uses: actions/setup-node@v6
142+
with:
143+
node-version: 24
144+
cache: 'npm'
145+
146+
- name: Install dependencies
147+
run: npm ci --no-audit --no-fund --include=dev
148+
149+
- name: Build tokens
150+
run: npm run build:tokens
151+
152+
- name: Publish canary version
153+
run: |
154+
echo "$( jq '.version = "0.0.0"' package.json )" > package.json
155+
echo -e "---\n'@primer/primitives': patch\n---\n\nFake entry to force publishing" > .changeset/force-snapshot-release.md
156+
npx changeset version --snapshot
157+
npx changeset publish --tag canary
99158
env:
100-
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
101-
NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN_SHARED }}
159+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
102160

103-
- name: Output release version to summary
104-
if: ${{ steps.changesets.outputs.published}} = 'true'
161+
- name: Output canary version number
162+
id: commitStatus
163+
uses: actions/github-script@v7
164+
with:
165+
script: |
166+
const package = require(`${process.env.GITHUB_WORKSPACE}/package.json`)
167+
github.rest.repos.createCommitStatus({
168+
owner: context.repo.owner,
169+
repo: context.repo.repo,
170+
sha: context.sha,
171+
state: 'success',
172+
context: `Published ${package.name}`,
173+
description: package.version,
174+
target_url: `https://unpkg.com/${package.name}@${package.version}/`
175+
})
176+
// Output the release version for next step
177+
core.setOutput('packageVersion', package.version);
178+
// Output the package name for next step
179+
core.setOutput('packageName', package.name);
180+
181+
- name: Output canary version to summary
105182
env:
106-
VERSION: ${{ steps.changesets.outputs.publishedPackages[0].version }}
107-
PACKAGE_NAME: ${{ steps.changesets.outputs.publishedPackages[0].name }}
183+
VERSION: ${{ steps.commitStatus.outputs.packageVersion }}
184+
PACKAGE_NAME: ${{ steps.commitStatus.outputs.packageName }}
108185
run: |
109-
echo "### Latest release" >> $GITHUB_STEP_SUMMARY
186+
echo "### Latest canary release" >> $GITHUB_STEP_SUMMARY
110187
echo "[v$VERSION](https://unpkg.com/$PACKAGE_NAME@$VERSION/)" >> $GITHUB_STEP_SUMMARY
188+
- uses: ./.github/actions/upload-versions

‎.github/workflows/release_canary.yml‎

Lines changed: 0 additions & 77 deletions
This file was deleted.

‎.github/workflows/release_candidate.yml‎

Lines changed: 0 additions & 84 deletions
This file was deleted.

0 commit comments

Comments
 (0)