Skip to content

Commit a7de4c7

Browse files
jasuwienasjasuwienas
committed
docs: use ubuntu latest to publish npm ackage (#50)
Signed-off-by: Mariusz Jasuwienas <jasuwienas@gmail.com>
1 parent a372e2f commit a7de4c7

1 file changed

Lines changed: 242 additions & 21 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 242 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,269 @@
11
name: Release
22

33
on:
4-
push:
5-
branches:
6-
- 'rc/**'
7-
- 'release/**'
84
workflow_dispatch:
5+
inputs:
6+
dry-run-enabled:
7+
description: 'Perform Dry Run'
8+
type: boolean
9+
required: false
10+
default: true
11+
12+
defaults:
13+
run:
14+
shell: bash
915

1016
permissions:
17+
actions: read
18+
checks: write
1119
contents: write
20+
id-token: write
1221
issues: write
1322
pull-requests: write
1423
packages: write
15-
id-token: write # to enable use of OIDC for trusted publishing and npm provenance
1624

1725
jobs:
18-
release:
19-
runs-on: hl-contr-lin-lg
20-
name: Release
26+
prepare:
27+
name: Release / Prepare
28+
runs-on: hiero-cli-linux-medium
29+
outputs:
30+
version: ${{ steps.set-outputs.outputs.version }}
31+
need-release: ${{ steps.set-outputs.outputs.need-release }}
2132
steps:
2233
- name: Harden the runner (Audit all outbound calls)
23-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
34+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
2435
with:
2536
egress-policy: audit
2637

27-
- name: Checkout repository
28-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
38+
- name: Prepare Job
39+
uses: pandaswhocode/initialize-github-job@ffb7446339e8e6007b942312ac95457d1a20b6cf # 1.0.4
40+
with:
41+
checkout: 'true'
42+
checkout-ref: '${{ github.ref }}'
43+
checkout-token: '${{ secrets.GITHUB_TOKEN }}'
44+
setup-node: 'true'
45+
node-version: '24.12.0'
46+
node-registry: 'https://registry.npmjs.org/'
2947

30-
- name: Use Node.js [24]
31-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
48+
- name: Setup JQ
49+
uses: dcarbone/install-jq-action@b7ef57d46ece78760b4019dbc4080a1ba2a40b45 # v3.2.0
3250
with:
33-
node-version: 24.12.0
51+
version: 1.7
52+
53+
- name: Install Semantic Release
54+
run: |
55+
npm install -g semantic-release@25.0.2 @semantic-release/git@10.0.1 @semantic-release/github@12.0.2 @semantic-release/exec@7.1.0 gradle-semantic-release-plugin@1.7.6
56+
npm install -g conventional-changelog-conventionalcommits@9.1.0 @commitlint/cli@18.6.0 @commitlint/config-conventional@18.6.0
57+
npm install -g marked-mangle@1.1.6 marked-gfm-heading-id@3.1.2 semantic-release-conventional-commits@3.0.0
58+
59+
- name: Calculate Next Version (default branch)
60+
id: calculate-version
61+
env:
62+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
63+
GIT_AUTHOR_NAME: ${{ secrets.GIT_USER_NAME }}
64+
GIT_AUTHOR_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
65+
GIT_COMMITTER_NAME: ${{ secrets.GIT_USER_NAME }}
66+
GIT_COMMITTER_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
67+
run: |
68+
PROCEED="true"
69+
if [[ "${{ github.event.repository.default_branch }}" == "${{ github.ref_name }}" ]]; then
70+
if SEMREL_OUTPUT=$(npx semantic-release --dry-run 2>&1); then
71+
if echo "${SEMREL_OUTPUT}" | grep -q "The next release version is"; then
72+
echo "::notice file=flow-deploy-release-artifact.yaml::Semantic Release detected a new version"
73+
else
74+
echo "::notice file=flow-deploy-release-artifact.yaml::Semantic Release detected NO new version"
75+
PROCEED="false"
76+
fi
77+
else
78+
echo "::notice file=flow-deploy-release-artifact.yaml::Semantic Release did NOT run successfully"
79+
PROCEED="false"
80+
fi
81+
echo "::group::SemVer output"
82+
echo "${SEMREL_OUTPUT}"
83+
echo "::endgroup::"
84+
else
85+
if [[ "${{ inputs.dry-run-enabled }}" == "true" ]]; then
86+
jq -r '.version' './package.json' > VERSION
87+
PROCEED="true"
88+
else
89+
PROCEED="false"
90+
fi
91+
fi
92+
93+
echo "need-release=${PROCEED}" >> "${GITHUB_OUTPUT}"
3494
35-
- name: Install dependencies
36-
run: npm ci
95+
- name: Extract version
96+
id: set-outputs
97+
if: ${{ !cancelled() && always() }}
98+
run: |
99+
PROCEED="true"
100+
OUTVER=""
101+
102+
if [[ "${{ steps.calculate-version.outputs.need-release }}" == "true" ]] && [[ -f VERSION ]]; then
103+
cat VERSION
104+
TRIMMED_VERSION=$(cat VERSION | tr -d '[:space:]')
105+
OUTVER="${TRIMMED_VERSION}"
106+
echo "version=${TRIMMED_VERSION}"
107+
elif [[ "${{ steps.calculate-version.outputs.need-release }}" == "true" ]] && [[ "${{ inputs.dry-run-enabled }}" == "true" ]] && [[ ! -f VERSION ]]; then
108+
VER=$(jq -r '.version' './package.json')
109+
OUTVER="${VER}"
110+
echo "Dry run enabled and VERSION file not found, using package.json version: ${VER}"
111+
else
112+
PROCEED="false"
113+
fi
114+
115+
echo "version=${OUTVER}" >> "${GITHUB_OUTPUT}"
116+
echo "need-release=${PROCEED}" >> "${GITHUB_OUTPUT}"
117+
118+
create-github-release:
119+
name: Github / Release
120+
if: ${{ needs.prepare-release.outputs.need-release == 'true' }}
121+
runs-on: hiero-cli-linux-medium
122+
needs:
123+
- prepare
124+
outputs:
125+
npm-artifact-name: ${{ steps.set-publish-data.outputs.artifact-name }}
126+
steps:
127+
- name: Harden the runner (Audit all outbound calls)
128+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
129+
with:
130+
egress-policy: audit
37131

38-
- name: Install semantic release dependencies
132+
- name: Prepare job
133+
uses: pandaswhocode/initialize-github-job@ffb7446339e8e6007b942312ac95457d1a20b6cf # 1.0.4
134+
with:
135+
checkout: 'true'
136+
checkout-ref: '${{ github.ref }}'
137+
checkout-token: '${{ secrets.GITHUB_TOKEN }}'
138+
setup-node: 'true'
139+
node-version: '24.12.0'
140+
node-registry: 'https://registry.npmjs.org/'
141+
142+
- name: Install GnuPG Tools
39143
run: |
40-
npm install -g semantic-release@25.0.2 @semantic-release/git@10.0.1 @semantic-release/github@12.0.2 @semantic-release/exec@7.1.0
144+
if ! command -v gpg2 >/dev/null 2>&1; then
145+
echo "::group::Updating APT Repository Indices"
146+
sudo apt update
147+
echo "::endgroup::"
148+
echo "::group::Installing GnuPG Tools"
149+
sudo apt install -y gnupg2
150+
echo "::endgroup::"
151+
fi
152+
153+
- name: Import GPG key
154+
id: gpg_key
155+
uses: step-security/ghaction-import-gpg@69c854a83c7f79463f8bdf46772ab09826c560cd # v6.3.1
156+
with:
157+
gpg_private_key: ${{ secrets.GPG_KEY_CONTENTS }}
158+
passphrase: ${{ secrets.GPG_KEY_PASSPHRASE }}
159+
git_config_global: true
160+
git_user_signingkey: true
161+
git_commit_gpgsign: true
162+
git_tag_gpgsign: false
163+
164+
- name: Install Semantic Release
165+
run: |
166+
npm install -g semantic-release@25.0.2 @semantic-release/git@10.0.1 @semantic-release/github@12.0.2 @semantic-release/exec@7.1.0 gradle-semantic-release-plugin@1.7.6
41167
npm install -g conventional-changelog-conventionalcommits@9.1.0 @commitlint/cli@18.6.0 @commitlint/config-conventional@18.6.0
42168
npm install -g marked-mangle@1.1.6 marked-gfm-heading-id@3.1.2 semantic-release-conventional-commits@3.0.0
43169
44-
- name: Publish
45-
working-directory: ./contracts
170+
- name: Publish Semantic Release
46171
env:
47172
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
48-
run: npx semantic-release --ci
173+
GIT_AUTHOR_NAME: ${{ secrets.GIT_USER_NAME }}
174+
GIT_AUTHOR_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
175+
GIT_COMMITTER_NAME: ${{ secrets.GIT_USER_NAME }}
176+
GIT_COMMITTER_EMAIL: ${{ secrets.GIT_USER_EMAIL }}
177+
if: ${{ !cancelled() && !failure() }}
178+
run: |
179+
FLAGS=""
180+
if [[ "${{ inputs.dry-run-enabled }}" == "true" ]]; then
181+
FLAGS="--dry-run"
182+
fi
183+
184+
npx semantic-release --no-sign ${FLAGS}
185+
186+
if [[ -d "dist" ]]; then
187+
echo "Dist dir has the following contents:"
188+
ls dist
189+
fi
190+
191+
- name: Update version for dry run
192+
if: ${{ inputs.dry-run-enabled == true }}
193+
run: |
194+
npm version ${{ needs.prepare-release.outputs.version }} --no-git-tag-version
195+
196+
- name: Set publish data
197+
id: set-publish-data
198+
run: |
199+
VERSION=$(jq -r '.version' './package.json')
200+
CLI_NPM_PACKAGE_NAME="hiero-ledger-hiero-cli-${VERSION}.tgz"
201+
echo "artifact-name=${CLI_NPM_PACKAGE_NAME}" >> $GITHUB_OUTPUT
202+
203+
- name: Pack tarball
204+
run: |
205+
npm pack --pack-destination ./dist
206+
207+
- name: Verify Package
208+
run: |
209+
EXPECTED="./dist/${{ steps.set-publish-data.outputs.artifact-name }}"
210+
if [[ ! -f "${EXPECTED}" ]]; then
211+
echo "::error::Expected package not found: ${EXPECTED}"
212+
ls -la ./dist/
213+
exit 1
214+
fi
215+
echo "Package verified: ${EXPECTED} ($(du -h "${EXPECTED}" | cut -f1))"
216+
217+
- name: Upload Hiero Contracts package artifact
218+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
219+
with:
220+
name: cli-npm-package
221+
path: ./dist/${{ steps.set-publish-data.outputs.artifact-name }}
222+
if-no-files-found: error
223+
224+
publish-npm-package:
225+
name: Publish Hiero Contracts NPM package
226+
if: ${{ needs.prepare-release.outputs.need-release == 'true' && inputs.dry-run-enabled != true }}
227+
runs-on: ubuntu-latest
228+
needs:
229+
- create-github-release
230+
- prepare
231+
steps:
232+
- name: Harden the runner (Audit all outbound calls)
233+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
234+
with:
235+
egress-policy: audit
236+
237+
- name: Prepare Release
238+
uses: pandaswhocode/initialize-github-job@ffb7446339e8e6007b942312ac95457d1a20b6cf # 1.0.4
239+
with:
240+
checkout: 'true'
241+
checkout-ref: '${{ github.ref }}'
242+
checkout-token: '${{ secrets.GITHUB_TOKEN }}'
243+
setup-node: 'true'
244+
node-version: '24.12.0'
245+
node-registry: 'https://registry.npmjs.org/'
246+
247+
- name: Use Node.js [24]
248+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
249+
with:
250+
node-version: 24.12.0
251+
252+
- name: Download Hiero Contracts NPM package artifact
253+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
254+
with:
255+
name: cli-npm-package
256+
257+
- name: Publish Hiero Contracts NPM package
258+
run: |
259+
args="--access=public"
260+
if [[ "${{ inputs.dry-run-enabled }}" == "true" ]]; then
261+
args="${args} --dry-run"
262+
else
263+
args="${args} --provenance"
264+
fi
265+
266+
package="${{ needs.create-github-release.outputs.npm-artifact-name }}"
267+
echo "::group::Publishing package: ${package} with args: ${args}"
268+
npm publish ${package} ${args}
269+
echo "::endgroup::"

0 commit comments

Comments
 (0)