v2.7.6-rc #53
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release permit Node SDK | |
| on: | |
| release: | |
| types: [published] | |
| env: | |
| PROJECT_ID: 7f55831d77c642739bc17733ab0af138 #github actions project id (under 'Permit.io Tests' workspace) | |
| ENV_NAME: node-sdk-ci | |
| jobs: | |
| publish_node_sdk: | |
| runs-on: ubuntu-latest | |
| environment: production | |
| permissions: | |
| contents: read | |
| id-token: write # Required for npm Trusted Publishing (OIDC) | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Upgrade npm for Trusted Publishing | |
| run: npm install -g npm@latest && npm --version | |
| - name: Set git user | |
| run: | | |
| git config --global user.email "eli@permit.io" | |
| git config --global user.name "elimoshkovich" | |
| - name: Install dependencies | |
| run: | | |
| rm -rf node_modules | |
| yarn install | |
| yarn run build | |
| yarn docs ; git add docs/ ; git commit -m "update tsdoc" | |
| - name: Creation env ${{ env.ENV_NAME }} under 'Permit.io Tests' workspace | |
| run: | | |
| response=$(curl -X POST \ | |
| https://api.permit.io/v2/projects/${{ env.PROJECT_ID }}/envs \ | |
| -H 'Authorization: Bearer ${{ secrets.PROJECT_API_KEY }}' \ | |
| -H 'Content-Type: application/json' \ | |
| -d '{ | |
| "key": "${{ env.ENV_NAME }}", | |
| "name": "${{ env.ENV_NAME }}" | |
| }') | |
| # Extract the new env id | |
| echo "ENV_ID=$(echo "$response" | jq -r '.id')" >> $GITHUB_ENV | |
| echo "New env ID: $ENV_ID" | |
| - name: Fetch API_KEY of ${{ env.ENV_NAME }} | |
| run: | | |
| response=$(curl -X GET \ | |
| https://api.permit.io/v2/api-key/${{ env.PROJECT_ID }}/${{ env.ENV_ID }} \ | |
| -H 'Authorization: Bearer ${{ secrets.PROJECT_API_KEY }}') | |
| # Extract the api key secret and register it for masking BEFORE writing | |
| # it to the environment, so it is redacted everywhere in the logs | |
| # (including the env-group dumps of every later step). Do not echo it. | |
| ENV_API_KEY=$(echo "$response" | jq -r '.secret') | |
| echo "::add-mask::$ENV_API_KEY" | |
| echo "ENV_API_KEY=$ENV_API_KEY" >> "$GITHUB_ENV" | |
| - name: local PDP runnning | |
| env: | |
| PDP_API_KEY: ${{ env.ENV_API_KEY }} | |
| PERMIT_API_KEY: ${{ env.ENV_API_KEY }} | |
| PDP_DEBUG: true | |
| run: docker run -d -p 7766:7000 permitio/pdp-v2:latest | |
| - name: Run tests | |
| env: | |
| PDP_API_KEY: ${{ env.ENV_API_KEY }} | |
| PERMIT_API_KEY: ${{ env.ENV_API_KEY }} | |
| API_TIER: 'prod' | |
| run: yarn test | |
| - name: Delete env ${{ env.ENV_NAME }} | |
| if: always() | |
| run: | | |
| curl -X DELETE \ | |
| https://api.permit.io/v2/projects/${{ env.PROJECT_ID }}/envs/${{ env.ENV_ID }} \ | |
| -H 'Authorization: Bearer ${{ secrets.PROJECT_API_KEY }}' | |
| - name: Bump version at package.json | |
| run: | | |
| # Use the release tag as the version, stripping any leading 'v' | |
| # (e.g. 'v2.7.6' -> '2.7.6') so it is valid semver for npm. | |
| VERSION=${{ github.event.release.tag_name }} | |
| VERSION=${VERSION#v} | |
| sed -i "s/\"version\": \".*\"/\"version\": \"$VERSION\"/" package.json | |
| cat package.json | |
| - name: Publish package to NPM | |
| run: | | |
| if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then | |
| echo "Publishing as a release candidate (rc)..." | |
| npm publish --access public --tag rc | |
| else | |
| echo "Publishing as the latest release..." | |
| npm publish --access public | |
| fi | |
| # No NPM_TOKEN needed — authenticated via npm Trusted Publishing (OIDC), | |
| # which requires the job's `id-token: write` permission above plus a | |
| # Trusted Publisher configured on npmjs.com: | |
| # permitio/permit-node -> Settings -> Trusted Publishers | |
| # (workflow: node_sdk_publish.yaml, environment: production) | |
| # Provenance attestations are generated automatically. | |