0.28.14 #8
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # https://docs.npmjs.com/trusted-publishers#github-actions-configuration | |
| name: publish | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| permissions: | |
| contents: read | |
| id-token: write # Required for OIDC | |
| jobs: | |
| npm: | |
| if: github.repository == 'kysely-org/kysely' | |
| environment: release | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 # Need full history to check branch ancestry | |
| - name: verify tag format and branch | |
| run: | | |
| # Validate ref_name format before assignment | |
| if [[ ! "${{ github.ref_name }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "Error: tag does not follow semver!" | |
| exit 1 | |
| fi | |
| TAG="${{ github.ref_name }}" | |
| # Check if tag points to a commit that exists on master branch | |
| TAG_COMMIT=$(git rev-list -n 1 "$TAG") | |
| if ! git merge-base --is-ancestor "$TAG_COMMIT" origin/master; then | |
| echo "Error: tag is not based on master branch" | |
| exit 1 | |
| fi | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 | |
| - name: Use Node.js | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| cache: pnpm | |
| node-version: lts/* | |
| registry-url: https://registry.npmjs.org/ | |
| - name: verify package version | |
| run: | | |
| TAG="${{ github.ref_name }}" | |
| VERSION="${TAG#v}" | |
| # Get version from package.json safely (parse as JSON, don't execute) | |
| PACKAGE_VERSION=$(node -p "JSON.parse(require('node:fs').readFileSync('./package.json', 'utf8')).version") | |
| # Validate version format: must be MAJOR.MINOR.PATCH | |
| if [[ ! "$PACKAGE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "Error: package.json version does not follow semver!" | |
| exit 1 | |
| fi | |
| # Verify versions match | |
| if [[ "$VERSION" != "$PACKAGE_VERSION" ]]; then | |
| echo "Error: tag and package.json version don't match!" | |
| exit 1 | |
| fi | |
| - name: Install dependencies | |
| run: npm i -g npm@^11.5.2 && pnpm i --frozen-lockfile --prefer-offline | |
| - name: Publish | |
| run: pnpm publish --no-git-checks # the workflow runs in a detached head state, so git checks fail | |
| jsr: | |
| needs: npm | |
| environment: release | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 | |
| - name: Use Node.js | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| cache: 'pnpm' | |
| node-version: lts/* | |
| - name: Install dependencies | |
| run: pnpm i | |
| - name: Prepare for publish | |
| run: pnpm script:remove-global-augmentations | |
| - name: publish | |
| run: pnpm jsr publish --allow-dirty |