devextreme-cli/.github/workflows/publish.yml at master · DevExpress/devextreme-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
name: Build and publish NPM packages

on:
  workflow_dispatch:
    inputs:
      dry-run:
        description: 'Run in dry-run mode (no actual publish)'
        type: boolean
        default: false

permissions: {}

jobs:
  build:
    name: Build NPM packages
    runs-on: ubuntu-slim
    permissions:
      contents: read
      packages: write

    steps:
      - name: Get sources
        uses: actions/checkout@v7

      - name: Install pnpm
        uses: pnpm/action-setup@v6

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: '.node-version'
          cache: 'pnpm'
          cache-dependency-path: |
            pnpm-lock.yaml
            tools/make-sbom/pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Test devextreme-schematics
        run: pnpm --filter devextreme-schematics run test

      - name: Build devextreme-schematics
        run: pnpm --filter devextreme-schematics run build

      - name: Pack packages
        run: |
          package_cli_tgz="$(pnpm --filter devextreme-cli pack --json | jq -er 'if type=="array" then .[0].filename else .filename end')"
          package_schematics_tgz="$(pnpm --filter devextreme-schematics pack --json | jq -er 'if type=="array" then .[0].filename else .filename end')"

          echo "PACKAGE_CLI_TGZ=$(realpath "$package_cli_tgz")" >> "$GITHUB_ENV"
          echo "PACKAGE_SCHEMATICS_TGZ=$(realpath "$package_schematics_tgz")" >> "$GITHUB_ENV"

      - name: Upload devextreme-cli package
        uses: actions/upload-artifact@v7
        with:
          name: package-cli
          path: ${{ env.PACKAGE_CLI_TGZ }}
          if-no-files-found: error

      - name: Upload devextreme-schematics package
        uses: actions/upload-artifact@v7
        with:
          name: package-schematics
          path: ${{ env.PACKAGE_SCHEMATICS_TGZ }}
          if-no-files-found: error

      - name: Set GitHub Packages auth
        run: pnpm set //npm.pkg.github.com/:_authToken='${NODE_AUTH_TOKEN}'

      - name: Publish devextreme-cli to GitHub Packages
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          package_dir="$RUNNER_TEMP/github-package-cli"
          rm -rf "$package_dir"
          mkdir -p "$package_dir"
          tar -xzf "$PACKAGE_CLI_TGZ" -C "$package_dir"
          jq --arg name "@devexpress/devextreme-cli" --arg registry "https://npm.pkg.github.com" '.name = $name | .publishConfig = ((.publishConfig // {}) + {registry:$registry})' "$package_dir/package/package.json" > "$package_dir/package/package.json.tmp"
          mv "$package_dir/package/package.json.tmp" "$package_dir/package/package.json"
          github_package_tgz="$package_dir/github-package.tgz"
          tar -czf "$github_package_tgz" -C "$package_dir" package
          pnpm publish "$github_package_tgz" --no-git-checks

      - name: Publish devextreme-schematics to GitHub Packages
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          package_dir="$RUNNER_TEMP/github-package-schematics"
          rm -rf "$package_dir"
          mkdir -p "$package_dir"
          tar -xzf "$PACKAGE_SCHEMATICS_TGZ" -C "$package_dir"
          jq --arg name "@devexpress/devextreme-schematics" --arg registry "https://npm.pkg.github.com" '.name = $name | .publishConfig = ((.publishConfig // {}) + {registry:$registry})' "$package_dir/package/package.json" > "$package_dir/package/package.json.tmp"
          mv "$package_dir/package/package.json.tmp" "$package_dir/package/package.json"
          github_package_tgz="$package_dir/github-package.tgz"
          tar -czf "$github_package_tgz" -C "$package_dir" package
          pnpm publish "$github_package_tgz" --no-git-checks

      - name: Build SBOMs
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          cd tools/make-sbom
          pnpm install --frozen-lockfile
          pnpm dx-make-sbom ../../ dist/ "devextreme-cli($PACKAGE_CLI_TGZ),devextreme-schematics($PACKAGE_SCHEMATICS_TGZ)"

      - name: Validate SBOMs
        uses: DevExpress/github-actions/validate-sbom@5034a6d5e0fd18fc2826ed20a5140f9c83b8994f
        with:
          input-format: json
          input-files: |
            tools/make-sbom/dist/devextreme-cli.cdx.json
            tools/make-sbom/dist/devextreme-schematics.cdx.json

      - name: Publish devextreme-cli SBOM to GitHub Packages
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          version="$(pnpm pkg get version | tr -d '"')"
          mkdir -p tools/make-sbom/pack/devextreme-cli
          cp tools/make-sbom/dist/devextreme-cli.cdx.json tools/make-sbom/pack/devextreme-cli
          jq -n --arg v "$version" '{name:"@devexpress/devextreme-cli-sbom",version:$v,publishConfig:{registry:"https://npm.pkg.github.com"}}' > tools/make-sbom/pack/devextreme-cli/package.json
          cd tools/make-sbom/pack/devextreme-cli
          pnpm publish --no-git-checks

      - name: Publish devextreme-schematics SBOM to GitHub Packages
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          version="$(pnpm pkg get version | tr -d '"')"
          mkdir -p tools/make-sbom/pack/devextreme-schematics
          cp tools/make-sbom/dist/devextreme-schematics.cdx.json tools/make-sbom/pack/devextreme-schematics
          jq -n --arg v "$version" '{name:"@devexpress/devextreme-schematics-sbom",version:$v,publishConfig:{registry:"https://npm.pkg.github.com"}}' > tools/make-sbom/pack/devextreme-schematics/package.json
          cd tools/make-sbom/pack/devextreme-schematics
          pnpm publish --no-git-checks

  publish:
    name: Publish NPM packages
    needs: build
    runs-on: ubuntu-slim
    environment: npmjs
    permissions:
      id-token: write  # Required for OIDC (Trusted Publishing)
      contents: read

    steps:
      - name: Get sources
        uses: actions/checkout@v7

      - name: Install pnpm
        uses: pnpm/action-setup@v6

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: '.node-version'

      - name: Download devextreme-cli package
        uses: actions/download-artifact@v7
        with:
          name: package-cli
          path: package-cli

      - name: Download devextreme-schematics package
        uses: actions/download-artifact@v7
        with:
          name: package-schematics
          path: package-schematics

      - name: Publish devextreme-cli
        run: |
          package_cli_tgz=$(ls package-cli/*.tgz)
          pnpm publish "$package_cli_tgz" --provenance --no-git-checks ${{ inputs['dry-run'] && '--dry-run' || '' }}

      - name: Publish devextreme-schematics
        run: |
          package_schematics_tgz=$(ls package-schematics/*.tgz)
          pnpm publish "$package_schematics_tgz" --provenance --no-git-checks ${{ inputs['dry-run'] && '--dry-run' || '' }}