chore: remove deploy script, deployments.json, and their five depende… #11
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Tag-driven releases publish the tagged version. Every publish — prerelease and | |
| # stable alike — runs in the reviewer-gated `Production` environment. npm supports | |
| # only one trusted publisher per package with one optional environment claim, so | |
| # pinning that publisher to `Production` requires every publishing job to run there. | |
| # It also makes the `rc` a faithful rehearsal: it exercises the same environment and | |
| # credential path the stable release will use, instead of a parallel one that can | |
| # drift out from under it. | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ══════════════════════════════════════════════════════════════════════════════ | |
| # PUBLISH JOB | |
| # ══════════════════════════════════════════════════════════════════════════════ | |
| release: | |
| name: Publish | |
| # Single environment for every tag — see the note at the top of this file. | |
| # Prereleases pay one approval click; that is the cost of the npm-side pin. | |
| environment: Production | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: read # checkout (the tag already exists) | |
| id-token: write # OIDC token for npm Trusted Publishing | |
| env: | |
| PROJECT_NAME: '@aztec-foundation/aztec-standards' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 | |
| # Toolchain is pinned via package.json `config.aztecVersion`: this action | |
| # reads that field and installs the matching Aztec version. | |
| - name: Setup Aztec environment | |
| id: setup-aztec | |
| uses: AztecProtocol/aztec-ci-actions/actions/setup-aztec@431859e477234b8690eb1f80d1305d2e34f10f1b # v0.1.1 | |
| with: | |
| start-pxe: 'false' | |
| run-codegen: 'true' | |
| # Validate that the tag (v5.0.0) matches package.json and derive the npm | |
| # dist-tag: `latest` for a final release, or the prerelease identifier | |
| # (rc / beta / nightly) so consumers can `npm i pkg@rc`. | |
| - name: Resolve release metadata | |
| id: meta | |
| run: | | |
| VERSION="${GITHUB_REF_NAME#v}" | |
| PKG_VERSION=$(node -p "require('./package.json').version") | |
| echo "Tag version: $VERSION" | |
| echo "package.json version: $PKG_VERSION" | |
| if [ "$VERSION" != "$PKG_VERSION" ]; then | |
| echo "::error::Tag ${GITHUB_REF_NAME} (version $VERSION) does not match package.json version ($PKG_VERSION)." | |
| exit 1 | |
| fi | |
| if [[ "$VERSION" == *-* ]]; then | |
| PRERELEASE="${VERSION#*-}" # e.g. "rc.2" | |
| DIST_TAG="${PRERELEASE%%.*}" # e.g. "rc" | |
| else | |
| DIST_TAG="latest" | |
| fi | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| echo "dist_tag=$DIST_TAG" >> "$GITHUB_OUTPUT" | |
| echo "Resolved npm dist-tag: $DIST_TAG" | |
| - name: Build package | |
| run: yarn build | |
| - name: Setup Node.js for NPM publish | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| # npm Trusted Publishing requires Node >=22.14.0 and npm >=11.5.1. | |
| node-version: '22.14.0' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Install OIDC-capable npm | |
| run: npm install --global npm@11.5.1 | |
| # npm versions are immutable. OIDC supports publish but not dist-tag mutation, | |
| # so reruns verify the existing dist-tag rather than trying to repair it. | |
| - name: Publish to NPM with OIDC | |
| run: | | |
| cd "export/${PROJECT_NAME}" | |
| VERSION="${{ steps.meta.outputs.version }}" | |
| DIST_TAG="${{ steps.meta.outputs.dist_tag }}" | |
| if npm view "${PROJECT_NAME}@${VERSION}" version >/dev/null 2>&1; then | |
| TAGGED_VERSION=$(npm view "${PROJECT_NAME}@${DIST_TAG}" version 2>/dev/null || true) | |
| if [ "$TAGGED_VERSION" != "$VERSION" ]; then | |
| echo "::error::${PROJECT_NAME}@${VERSION} is already published, but dist-tag '${DIST_TAG}' points to '${TAGGED_VERSION:-nothing}'. OIDC cannot mutate dist-tags; repair it manually with an authorized npm account." | |
| exit 1 | |
| fi | |
| echo "::notice::${PROJECT_NAME}@${VERSION} already published and dist-tag '${DIST_TAG}' is correct — skipping publish." | |
| else | |
| # Trusted Publishing generates provenance automatically for public packages. | |
| npm publish --access public --tag "${DIST_TAG}" | |
| fi | |
| # Post-publish smoke test: install the just-published package from the registry (clean dir) | |
| # and confirm it resolves to the expected version. Catches "published but unusable" | |
| # (bad files/exports/version). The publish already succeeded and npm is immutable, so a | |
| # persistent miss here is a WARNING (registry propagation lag — common on a first publish), | |
| # NOT a release failure. A version MISMATCH after install still hard-fails. | |
| - name: Smoke-test published package | |
| run: | | |
| VERSION="${{ steps.meta.outputs.version }}" | |
| DIST_TAG="${{ steps.meta.outputs.dist_tag }}" | |
| workdir="$(mktemp -d)" | |
| cd "$workdir" | |
| npm init -y >/dev/null | |
| # First publishes propagate slowly; --prefer-online bypasses the negative cache. Back off ~2min. | |
| installed=false | |
| for attempt in 1 2 3 4 5 6 7 8; do | |
| if npm install --prefer-online "${PROJECT_NAME}@${VERSION}"; then installed=true; break; fi | |
| echo "install attempt ${attempt} failed; waiting 15s for registry propagation..." | |
| sleep 15 | |
| done | |
| if [ "$installed" = true ]; then | |
| node -e "const p = require('${PROJECT_NAME}/package.json'); if (p.version !== '${VERSION}') { throw new Error('installed ' + p.version + ', expected ${VERSION}'); } console.log('smoke ok:', p.name, p.version);" | |
| echo "::notice::Smoke test passed: ${PROJECT_NAME}@${VERSION} installs and resolves (dist-tag ${DIST_TAG})." | |
| else | |
| echo "::warning::${PROJECT_NAME}@${VERSION} published successfully but did not resolve from the registry within the wait window (propagation lag — common on a first publish). Verify manually: npm view ${PROJECT_NAME}@${VERSION} --prefer-online" | |
| fi |