0.29.0-rc.0 #11
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # https://docs.npmjs.com/trusted-publishers#github-actions-configuration | |
| name: publish | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| permissions: | |
| contents: read | |
| id-token: write # Required for OIDC | |
| jobs: | |
| npm: | |
| if: github.repository == 'kysely-org/kysely' | |
| environment: release | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 # Need full history to check branch ancestry | |
| - name: verify tag format and branch | |
| run: | | |
| # Validate ref_name format before assignment | |
| if [[ ! "${{ github.ref_name }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$ ]]; then | |
| echo "Error: tag does not follow semver!" | |
| exit 1 | |
| fi | |
| TAG="${{ github.ref_name }}" | |
| # Route stable tags to master/latest, RC tags to next/next | |
| if [[ "$TAG" =~ -rc\.[0-9]+$ ]]; then | |
| BRANCH=next | |
| DIST_TAG=next | |
| else | |
| BRANCH=master | |
| DIST_TAG=latest | |
| fi | |
| # Check if tag points to a commit that exists on the expected branch | |
| TAG_COMMIT=$(git rev-list -n 1 "$TAG") | |
| if ! git merge-base --is-ancestor "$TAG_COMMIT" "origin/$BRANCH"; then | |
| echo "Error: tag is not based on $BRANCH branch" | |
| exit 1 | |
| fi | |
| echo "DIST_TAG=$DIST_TAG" >> "$GITHUB_ENV" | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 | |
| - name: Use Node.js | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| cache: pnpm | |
| node-version: lts/* | |
| registry-url: https://registry.npmjs.org/ | |
| - name: verify package version | |
| run: | | |
| TAG="${{ github.ref_name }}" | |
| VERSION="${TAG#v}" | |
| # Get version from package.json safely (parse as JSON, don't execute) | |
| PACKAGE_VERSION=$(node -p "JSON.parse(require('node:fs').readFileSync('./package.json', 'utf8')).version") | |
| # Validate version format: must be MAJOR.MINOR.PATCH or MAJOR.MINOR.PATCH-rc.N | |
| if [[ ! "$PACKAGE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$ ]]; then | |
| echo "Error: package.json version does not follow semver!" | |
| exit 1 | |
| fi | |
| # Verify versions match | |
| if [[ "$VERSION" != "$PACKAGE_VERSION" ]]; then | |
| echo "Error: tag and package.json version don't match!" | |
| exit 1 | |
| fi | |
| - name: Install dependencies | |
| run: npm i -g npm@^11.5.2 && pnpm i --frozen-lockfile --prefer-offline | |
| - name: Publish | |
| run: pnpm publish --no-git-checks --tag "$DIST_TAG" # the workflow runs in a detached head state, so git checks fail | |
| jsr: | |
| needs: npm | |
| environment: release | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 | |
| - name: Use Node.js | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| cache: 'pnpm' | |
| node-version: lts/* | |
| - name: Install dependencies | |
| run: pnpm i | |
| - name: Prepare for publish | |
| run: pnpm script:remove-global-augmentations | |
| - name: publish | |
| run: pnpm jsr publish --allow-dirty |