0.29.5 #20
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # https://docs.npmjs.com/trusted-publishers#github-actions-configuration | |
| name: publish | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| permissions: {} | |
| jobs: | |
| npm: | |
| concurrency: | |
| cancel-in-progress: false | |
| group: ${{ github.workflow }}-npm | |
| environment: release | |
| if: github.repository == 'kysely-org/kysely' | |
| name: publish to npm | |
| permissions: | |
| contents: read | |
| id-token: write # Required for OIDC | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 # Need full history to check branch ancestry | |
| persist-credentials: false | |
| - name: verify tag format and branch | |
| env: | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| # Validate ref_name format before using it | |
| if [[ ! "$REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-(beta|rc)\.[0-9]+)?$ ]]; then | |
| echo "Error: tag does not follow semver!" | |
| exit 1 | |
| fi | |
| TAG="$REF_NAME" | |
| # Route stable tags to master/latest, prerelease (beta/rc) tags to next/next | |
| if [[ "$TAG" =~ -(beta|rc)\.[0-9]+$ ]]; then | |
| BRANCH=next | |
| DIST_TAG=next | |
| else | |
| BRANCH=master | |
| DIST_TAG=latest | |
| fi | |
| # Check if tag points to a commit that exists on the expected branch | |
| TAG_COMMIT=$(git rev-list -n 1 "$TAG") | |
| if ! git merge-base --is-ancestor "$TAG_COMMIT" "origin/$BRANCH"; then | |
| echo "Error: tag is not based on $BRANCH branch" | |
| exit 1 | |
| fi | |
| echo "TAG=$TAG" >> "$GITHUB_ENV" | |
| echo "DIST_TAG=$DIST_TAG" >> "$GITHUB_ENV" | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| with: | |
| cache: false # cache can be poisoned by malicious actors. | |
| - name: Use Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: lts/* | |
| package-manager-cache: false # cache can be poisoned by malicious actors. | |
| registry-url: https://registry.npmjs.org/ | |
| - name: verify package version | |
| run: | | |
| # TAG was validated and set in the previous step via $GITHUB_ENV | |
| VERSION="${TAG#v}" | |
| # Get version from package.json safely (parse as JSON, don't execute) | |
| PACKAGE_VERSION=$(node -p "JSON.parse(require('node:fs').readFileSync('./package.json', 'utf8')).version") | |
| # Validate version format: must be MAJOR.MINOR.PATCH or MAJOR.MINOR.PATCH-beta.N/-rc.N | |
| if [[ ! "$PACKAGE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-(beta|rc)\.[0-9]+)?$ ]]; then | |
| echo "Error: package.json version does not follow semver!" | |
| exit 1 | |
| fi | |
| # Verify versions match | |
| if [[ "$VERSION" != "$PACKAGE_VERSION" ]]; then | |
| echo "Error: tag and package.json version don't match!" | |
| exit 1 | |
| fi | |
| - name: Install dependencies | |
| run: pnpm i --frozen-lockfile --prefer-offline | |
| - name: Publish | |
| run: pnpm stage publish --no-git-checks --tag "$DIST_TAG" # the workflow runs in a detached head state, so git checks fail | |
| jsr: | |
| concurrency: | |
| cancel-in-progress: false | |
| group: ${{ github.workflow }}-jsr | |
| environment: release | |
| needs: npm | |
| name: publish to jsr | |
| permissions: | |
| contents: read | |
| id-token: write # Required for OIDC | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| with: | |
| cache: false # cache can be poisoned by malicious actors. | |
| - name: Use Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: lts/* | |
| package-manager-cache: false # cache can be poisoned by malicious actors. | |
| registry-url: https://registry.npmjs.org/ | |
| - name: Install dependencies | |
| run: pnpm i | |
| - name: Prepare for publish | |
| run: pnpm script:remove-global-augmentations | |
| - name: publish | |
| run: pnpm jsr publish --allow-dirty |