segments the web interface will actually list (#12) #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: ['v*'] | |
| permissions: | |
| contents: read | |
| # Required for npm trusted publishing: the job exchanges a short-lived OIDC | |
| # token for publish rights, so no NPM_TOKEN is stored anywhere. | |
| id-token: write | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Deliberately no registry-url here. It makes setup-node write an .npmrc | |
| # that conflicts with OIDC authentication. | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '24' | |
| cache: npm | |
| # Trusted publishing needs a recent CLI; the one bundled with Node may lag. | |
| - run: npm install -g npm@latest | |
| - run: npm ci | |
| - run: npm run typecheck | |
| - run: npm test | |
| - run: npm run build | |
| # The tag is the only place a release version exists. package.json carries | |
| # 0.0.0-dev in git and is stamped here, after the tests have run against | |
| # the placeholder and before anything is packed. Nothing is committed: | |
| # the tree that ships is the tagged one plus this one field. | |
| # | |
| # A test enforces the placeholder, so a tree that got this far cannot have | |
| # smuggled a version in, and the stamp can never disagree with the tag. | |
| - name: Take the version from the tag | |
| run: | | |
| version="${GITHUB_REF_NAME#v}" | |
| if ! printf '%s' "$version" \ | |
| | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$'; then | |
| echo "tag $GITHUB_REF_NAME does not name a version" | |
| exit 1 | |
| fi | |
| npm version "$version" --no-git-tag-version | |
| echo "publishing $(node -p 'require("./package.json").version')" | |
| # Provenance ties the tarball to this workflow run, so anyone can verify it | |
| # was built from this commit rather than someone's laptop. | |
| # | |
| # A misconfigured trusted publisher surfaces here as a misleading 404 or | |
| # ENEEDAUTH rather than a clear message. Check that the publisher on npm | |
| # names this repository and this workflow filename exactly. | |
| - run: npm publish --provenance --access public |