Skip to content

Commit 547b1da

Browse files
bntvllntbntvllnt
authored
ci: split CI and publish into separate workflows (#4)
CI runs quality gates on PRs only. Publish handles canary (on push to main) and release (via workflow_dispatch) with OIDC provenance and auto-changelog.
1 parent 5d07684 commit 547b1da

2 files changed

Lines changed: 203 additions & 45 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 9 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,23 @@ name: CI
33
on:
44
pull_request:
55
branches: [main]
6-
push:
7-
branches: [main]
8-
tags: ["v*"]
6+
7+
concurrency:
8+
group: ci-${{ github.head_ref }}
9+
cancel-in-progress: true
910

1011
jobs:
11-
ci:
12+
quality:
13+
name: Quality Gates
1214
runs-on: ubuntu-latest
13-
strategy:
14-
matrix:
15-
node-version: [18, 20, 22]
1615
steps:
1716
- uses: actions/checkout@v4
1817

1918
- uses: pnpm/action-setup@v4
2019

2120
- uses: actions/setup-node@v4
2221
with:
23-
node-version: ${{ matrix.node-version }}
22+
node-version: 22
2423
cache: pnpm
2524

2625
- run: pnpm install --frozen-lockfile
@@ -34,40 +33,5 @@ jobs:
3433
- name: Build
3534
run: pnpm build
3635

37-
- name: Test with coverage
38-
run: pnpm test -- --coverage
39-
40-
- name: Upload coverage
41-
if: matrix.node-version == 22
42-
uses: actions/upload-artifact@v4
43-
with:
44-
name: coverage-report
45-
path: coverage/
46-
47-
publish:
48-
needs: ci
49-
if: startsWith(github.ref, 'refs/tags/v')
50-
runs-on: ubuntu-latest
51-
permissions:
52-
contents: read
53-
id-token: write
54-
steps:
55-
- uses: actions/checkout@v4
56-
57-
- uses: pnpm/action-setup@v4
58-
59-
- uses: actions/setup-node@v4
60-
with:
61-
node-version: 22
62-
cache: pnpm
63-
registry-url: https://registry.npmjs.org
64-
65-
- run: pnpm install --frozen-lockfile
66-
67-
- name: Build
68-
run: pnpm build
69-
70-
- name: Publish to npm
71-
run: npm publish --access public --provenance
72-
env:
73-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
36+
- name: Test
37+
run: pnpm test

‎.github/workflows/publish.yml‎

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
name: Publish
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- "src/**"
8+
- "pnpm-lock.yaml"
9+
- ".github/workflows/publish.yml"
10+
workflow_dispatch:
11+
inputs:
12+
bump:
13+
description: "Version bump type"
14+
required: true
15+
type: choice
16+
options:
17+
- patch
18+
- minor
19+
- major
20+
21+
concurrency:
22+
group: publish-${{ github.event_name }}
23+
cancel-in-progress: true
24+
25+
permissions:
26+
contents: write
27+
id-token: write
28+
29+
jobs:
30+
quality:
31+
name: Quality Gates
32+
runs-on: ubuntu-latest
33+
steps:
34+
- uses: actions/checkout@v4
35+
36+
- uses: pnpm/action-setup@v4
37+
38+
- uses: actions/setup-node@v4
39+
with:
40+
node-version: 22
41+
cache: pnpm
42+
43+
- run: pnpm install --frozen-lockfile
44+
45+
- name: Lint
46+
run: pnpm lint
47+
48+
- name: Typecheck
49+
run: pnpm typecheck
50+
51+
- name: Build
52+
run: pnpm build
53+
54+
- name: Test
55+
run: pnpm test
56+
57+
canary:
58+
name: Publish Canary
59+
needs: quality
60+
if: github.event_name == 'push'
61+
runs-on: ubuntu-latest
62+
permissions:
63+
id-token: write
64+
contents: read
65+
steps:
66+
- uses: actions/checkout@v4
67+
68+
- uses: pnpm/action-setup@v4
69+
70+
- uses: actions/setup-node@v4
71+
with:
72+
node-version: 22
73+
cache: pnpm
74+
registry-url: https://registry.npmjs.org
75+
76+
- run: pnpm install --frozen-lockfile
77+
78+
- name: Build
79+
run: pnpm build
80+
81+
- name: Upgrade npm for OIDC support
82+
run: npm install -g npm@latest
83+
84+
- name: Publish canary
85+
run: |
86+
sed -i '/_authToken/d' "$NPM_CONFIG_USERCONFIG"
87+
unset NODE_AUTH_TOKEN
88+
BASE_VERSION=$(node -p "require('./package.json').version")
89+
SHORT_SHA=$(echo "$GITHUB_SHA" | cut -c1-7)
90+
CANARY_VERSION="${BASE_VERSION}-canary.${SHORT_SHA}"
91+
npm version "$CANARY_VERSION" --no-git-tag-version
92+
TARBALL=$(pnpm pack --pack-destination /tmp | tail -1)
93+
npm publish "$TARBALL" --tag canary --provenance --access public
94+
95+
release:
96+
name: Publish Release
97+
needs: quality
98+
if: github.event_name == 'workflow_dispatch'
99+
runs-on: ubuntu-latest
100+
permissions:
101+
contents: write
102+
id-token: write
103+
steps:
104+
- uses: actions/checkout@v4
105+
with:
106+
fetch-depth: 0
107+
token: ${{ secrets.GITHUB_TOKEN }}
108+
109+
- uses: pnpm/action-setup@v4
110+
111+
- uses: actions/setup-node@v4
112+
with:
113+
node-version: 22
114+
cache: pnpm
115+
registry-url: https://registry.npmjs.org
116+
117+
- run: pnpm install --frozen-lockfile
118+
119+
- name: Build
120+
run: pnpm build
121+
122+
- name: Bump version
123+
id: version
124+
run: |
125+
npm version ${{ inputs.bump }} --no-git-tag-version
126+
VERSION=$(node -p "require('./package.json').version")
127+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
128+
129+
- name: Generate changelog
130+
id: changelog
131+
run: |
132+
LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
133+
if [ -z "$LAST_TAG" ]; then
134+
RANGE="HEAD"
135+
else
136+
RANGE="${LAST_TAG}..HEAD"
137+
fi
138+
139+
{
140+
echo "body<<CHANGELOG_EOF"
141+
142+
FEATS=$(git log "$RANGE" --pretty=format:"%s" --grep="^feat" 2>/dev/null || true)
143+
if [ -n "$FEATS" ]; then
144+
echo "### Features"
145+
echo "$FEATS" | sed 's/^/- /'
146+
echo ""
147+
fi
148+
149+
FIXES=$(git log "$RANGE" --pretty=format:"%s" --grep="^fix" 2>/dev/null || true)
150+
if [ -n "$FIXES" ]; then
151+
echo "### Bug Fixes"
152+
echo "$FIXES" | sed 's/^/- /'
153+
echo ""
154+
fi
155+
156+
OTHERS=$(git log "$RANGE" --pretty=format:"%s" --invert-grep --grep="^feat" --grep="^fix" 2>/dev/null || true)
157+
if [ -n "$OTHERS" ]; then
158+
echo "### Other Changes"
159+
echo "$OTHERS" | sed 's/^/- /'
160+
echo ""
161+
fi
162+
163+
echo "CHANGELOG_EOF"
164+
} >> "$GITHUB_OUTPUT"
165+
166+
- name: Commit and tag
167+
run: |
168+
git config user.name "github-actions[bot]"
169+
git config user.email "github-actions[bot]@users.noreply.github.com"
170+
git add package.json
171+
git commit -m "chore(release): v${{ steps.version.outputs.version }}"
172+
git tag -a "v${{ steps.version.outputs.version }}" -m "v${{ steps.version.outputs.version }}"
173+
git push origin main --follow-tags
174+
175+
- name: Upgrade npm for OIDC support
176+
run: npm install -g npm@latest
177+
178+
- name: Publish to npm
179+
run: |
180+
sed -i '/_authToken/d' "$NPM_CONFIG_USERCONFIG"
181+
unset NODE_AUTH_TOKEN
182+
TARBALL=$(pnpm pack --pack-destination /tmp | tail -1)
183+
npm publish "$TARBALL" --tag latest --provenance --access public
184+
185+
- name: Create GitHub Release
186+
env:
187+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
188+
run: |
189+
cat <<'NOTES_EOF' > /tmp/release-notes.md
190+
${{ steps.changelog.outputs.body }}
191+
NOTES_EOF
192+
gh release create "v${{ steps.version.outputs.version }}" \
193+
--title "v${{ steps.version.outputs.version }}" \
194+
--notes-file /tmp/release-notes.md

0 commit comments

Comments
 (0)