google-profanity-words/.github/workflows/release.yml at 3a872ea78c163a92363e925e182d2334fb100917 · coffee-and-fun/google-profanity-words · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
name: Release

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      version:
        description: 'Tag to republish (e.g. v3.1.5). Leave blank to no-op.'
        required: false
        type: string

permissions:
  contents: read

jobs:
  release-please:
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    permissions:
      contents: write
      pull-requests: write
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      - name: Run Release Please
        id: release
        uses: googleapis/release-please-action@v4
        with:
          config-file: .github/release-please-config.json
          manifest-file: .github/.release-please-manifest.json

  test:
    needs: release-please
    if: |
      always() &&
      (needs.release-please.outputs.release_created == 'true' ||
       github.event_name == 'workflow_dispatch')
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        node-version: [22]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.version || needs.release-please.outputs.tag_name }}

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm test

  verify-version:
    needs: [release-please, test]
    if: |
      always() && needs.test.result == 'success' &&
      (needs.release-please.outputs.release_created == 'true' ||
       github.event_name == 'workflow_dispatch')
    runs-on: ubuntu-latest
    steps:
      - name: Resolve tag
        id: tag
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "name=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
          else
            echo "name=${{ needs.release-please.outputs.tag_name }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout tag
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.tag.outputs.name }}

      - name: Compare package.json version to tag
        env:
          TAG_NAME: ${{ steps.tag.outputs.name }}
        run: |
          TAG_VERSION="${TAG_NAME##*v}"
          PKG_VERSION=$(node -p "require('./package.json').version")
          echo "Tag:     $TAG_VERSION"
          echo "package: $PKG_VERSION"
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "::error::Tag $TAG_NAME does not match package.json version $PKG_VERSION"
            exit 1
          fi

  publish-npm:
    needs: [release-please, test, verify-version]
    if: |
      always() && needs.verify-version.result == 'success' &&
      (needs.release-please.outputs.release_created == 'true' ||
       github.event_name == 'workflow_dispatch')
    runs-on: ubuntu-latest
    environment: npm-publish
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Resolve tag
        id: tag
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "name=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
          else
            echo "name=${{ needs.release-please.outputs.tag_name }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout tag
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.tag.outputs.name }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: https://registry.npmjs.org/
          cache: npm

      - name: Upgrade npm (Trusted Publishing needs 11.5.1+)
        run: npm install -g npm@latest

      - name: Install dependencies
        run: npm ci

      - name: Publish to npm with provenance
        run: npm publish --provenance --access public