fix(deployer): ship the compose file behind proof_server auto #61
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Publishes to npm via OIDC trusted publishing, not a token. | |
| # Each package must list this repo and this workflow file as a Trusted | |
| # Publisher on npmjs.org, or the publish step fails to authenticate. | |
| name: Publish Release | |
| on: | |
| pull_request: | |
| types: [closed] | |
| branches: [main, beta] | |
| # Escape hatch: re-run a publish that failed mid-flow (e.g. after a fix to | |
| # this workflow). Reads the version from the package.json on the chosen ref. | |
| workflow_dispatch: | |
| inputs: | |
| package: | |
| description: "Package to (re)publish" | |
| required: true | |
| type: choice | |
| options: | |
| - compact-builder | |
| - compact-cli | |
| - compact-deployer | |
| - compact-simulator | |
| jobs: | |
| publish: | |
| name: Publish merged release | |
| if: >- | |
| github.event_name == 'workflow_dispatch' || | |
| (github.event.pull_request.merged == true && | |
| contains(github.event.pull_request.labels.*.name, 'release')) | |
| runs-on: ubuntu-24.04 | |
| environment: compact-npm-prod # Final approval gate before npm publish | |
| permissions: | |
| contents: write # push the version tag | |
| id-token: write # mint the npm OIDC credential and the provenance statement | |
| steps: | |
| - name: Get github app token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| id: gh-app-token | |
| with: | |
| app-id: ${{ vars.GH_APP_ID }} | |
| private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} | |
| # For pull_request runs: checkout the merge commit (deterministic view of | |
| # what was just merged). For manual dispatch: checkout the dispatched ref | |
| # (defaults to main but can be any branch — hotfix, release-prep, etc.). | |
| # The compact-npm-prod environment approval is the security gate, not the | |
| # branch ref. | |
| - name: Check out target ref | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.merge_commit_sha || github.ref }} | |
| token: ${{ steps.gh-app-token.outputs.token }} | |
| - name: Detect released package | |
| id: pkg | |
| env: | |
| EVENT: ${{ github.event_name }} | |
| MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }} | |
| INPUT_PACKAGE: ${{ inputs.package }} | |
| BASE_REF: ${{ github.event.pull_request.base.ref }} | |
| run: | | |
| if [[ "$EVENT" == "workflow_dispatch" ]]; then | |
| PKG="$INPUT_PACKAGE" | |
| case "$PKG" in | |
| compact-builder) DIR="builder" ;; | |
| compact-cli) DIR="cli" ;; | |
| compact-deployer) DIR="deployer" ;; | |
| compact-simulator) DIR="simulator" ;; | |
| *) | |
| echo "::error::unknown package: $PKG" | |
| exit 1 | |
| ;; | |
| esac | |
| else | |
| mapfile -t CHANGED < <(git diff --name-only "$MERGE_SHA^" "$MERGE_SHA" -- 'packages/*/package.json') | |
| COUNT=${#CHANGED[@]} | |
| if [[ "$COUNT" -ne 1 ]]; then | |
| echo "::error::expected exactly one packages/*/package.json change, found $COUNT" | |
| printf '%s\n' "${CHANGED[@]}" >&2 | |
| exit 1 | |
| fi | |
| DIR=$(echo "${CHANGED[0]}" | awk -F/ '{print $2}') | |
| case "$DIR" in | |
| builder) PKG="compact-builder" ;; | |
| cli) PKG="compact-cli" ;; | |
| deployer) PKG="compact-deployer" ;; | |
| simulator) PKG="compact-simulator" ;; | |
| *) | |
| echo "::error::unknown package directory: $DIR" | |
| exit 1 | |
| ;; | |
| esac | |
| fi | |
| VERSION=$(node -p "require('./packages/$DIR/package.json').version") | |
| # The dist-tag comes from the version alone, so a prerelease can never | |
| # take over `latest` regardless of which ref dispatched the run. | |
| PRERELEASE="${VERSION#*-}" | |
| if [[ "$PRERELEASE" == "$VERSION" ]]; then | |
| DIST_TAG=latest | |
| elif [[ "$PRERELEASE" == beta.* ]]; then | |
| DIST_TAG=beta | |
| else | |
| echo "::error::unsupported prerelease identifier in $VERSION; expected beta.N" | |
| exit 1 | |
| fi | |
| # On the merge path the base branch is known, so hold the two channels | |
| # apart: beta ships prereleases, main ships stable. | |
| if [[ "$EVENT" == "pull_request" ]]; then | |
| case "$BASE_REF:$DIST_TAG" in | |
| beta:beta|main:latest) ;; | |
| *) | |
| echo "::error::$VERSION (dist-tag $DIST_TAG) cannot be released from '$BASE_REF'" | |
| exit 1 | |
| ;; | |
| esac | |
| fi | |
| { | |
| echo "dir=$DIR" | |
| echo "name=$PKG" | |
| echo "version=$VERSION" | |
| echo "dist_tag=$DIST_TAG" | |
| } >> $GITHUB_OUTPUT | |
| { | |
| echo "### Publishing" | |
| echo "- Package: $PKG" | |
| echo "- Version: $VERSION" | |
| echo "- npm dist-tag: $DIST_TAG" | |
| echo "- Trigger: $EVENT" | |
| } >> $GITHUB_STEP_SUMMARY | |
| - name: Setup Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version-file: ".nvmrc" | |
| package-manager-cache: false # Prevent cache poisoning issues | |
| - name: Enable corepack | |
| run: corepack enable | |
| - name: Install dependencies | |
| run: yarn install --immutable | |
| - name: Build package | |
| run: yarn build --filter=@openzeppelin/${{ steps.pkg.outputs.name }} | |
| - name: Create and push tag | |
| env: | |
| TAG: ${{ steps.pkg.outputs.name }}/v${{ steps.pkg.outputs.version }} | |
| run: | | |
| if git ls-remote --tags --exit-code origin "refs/tags/$TAG" >/dev/null; then | |
| echo "tag $TAG already on origin, leaving it in place" | |
| else | |
| git tag "$TAG" | |
| git push origin "$TAG" | |
| fi | |
| - name: Publish to npm | |
| run: | | |
| cd packages/${{ steps.pkg.outputs.dir }} | |
| yarn npm publish --access public --provenance --tag ${{ steps.pkg.outputs.dist_tag }} |