ci: use local .npmrc to authenticate to the npm registry #11
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'CI/CD' | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - fes/v* | |
| - gml/v* | |
| - wfs/v* | |
| - xml/v* | |
| pull_request: | |
| branches: | |
| - main | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| ci: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| should_release: ${{ steps.should-release.outputs.should_release }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-tags: true | |
| - name: set up pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 9 | |
| - name: Install Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 # LTS as of 2025-01 | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install | |
| - name: check examples up-to-date | |
| run: |- | |
| ./scripts/update_examples.sh | |
| git --no-pager diff --exit-code # fail if there's any diff | |
| - name: Run tests | |
| run: make test | |
| - name: validate tags | |
| run: node ./scripts/checkTags.js | |
| - name: should release? | |
| id: should-release | |
| run: |- | |
| tags=""; tags="$(git --no-pager tag --points-at HEAD)" | |
| if [ -n "${tags:-}" ]; then | |
| echo "should_release=true" | tee -a "$GITHUB_OUTPUT"; | |
| fi | |
| publish: | |
| environment: release # <- this requires at least one tag like */v* | |
| if: needs.ci.outputs.should_release == 'true' | |
| runs-on: ubuntu-latest | |
| needs: [ci] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-tags: true | |
| - name: set up pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 9 | |
| - name: Install Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 # LTS as of 2025-01 | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: setup registry auth | |
| run: | | |
| echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' >> .npmrc | |
| - name: debug 1 | |
| run: git status | |
| - name: rebuild | |
| run: make build | |
| - name: debug 2 | |
| run: | | |
| git status | |
| cat .npmrc | |
| - name: publish | |
| run: | | |
| pnpm publish \ | |
| --recursive --provenance --no-git-checks \ | |
| --registry https://registry.npmjs.org/ \ | |
| --access public | |
| env: | |
| NPM_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }} | |
| # see also: https://github.blog/security/supply-chain-security/introducing-npm-package-provenance/ |