fix: resolve Dependabot alerts (#184) #101
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*"] | |
| permissions: | |
| id-token: write | |
| contents: write | |
| pages: write | |
| concurrency: | |
| group: release-${{ github.ref_name }} | |
| cancel-in-progress: false | |
| jobs: | |
| detect: | |
| if: ${{ github.repository == 'kasperrt/wiretyped' && !(startsWith(github.ref, 'refs/tags/') && github.actor == 'github-actions[bot]') }} | |
| runs-on: ubuntu-latest | |
| outputs: | |
| tag: ${{ steps.out.outputs.tag }} | |
| version: ${{ steps.out.outputs.version }} | |
| run: ${{ steps.out.outputs.run }} | |
| create_tag: ${{ steps.out.outputs.create_tag }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Determine tag/version | |
| id: meta | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [[ "${GITHUB_REF}" == refs/tags/* ]]; then | |
| TAG="${GITHUB_REF_NAME}" | |
| if [[ "$TAG" != v* ]]; then | |
| echo "ERROR: Tag must start with 'v' (got: $TAG)" | |
| exit 1 | |
| fi | |
| VERSION="${TAG#v}" | |
| if [ -z "$VERSION" ]; then | |
| echo "ERROR: Tag version is empty (got: $TAG)" | |
| exit 1 | |
| fi | |
| JSR_VERSION="$(jq -r '.version // empty' jsr.json)" | |
| PKG_VERSION="$(jq -r '.version // empty' package.json)" | |
| if [ -z "$JSR_VERSION" ] || [ -z "$PKG_VERSION" ]; then | |
| echo "ERROR: Missing version in jsr.json or package.json" | |
| exit 1 | |
| fi | |
| if [ "$JSR_VERSION" != "$PKG_VERSION" ]; then | |
| echo "ERROR: Version mismatch!" | |
| echo " jsr.json : $JSR_VERSION" | |
| echo " package.json : $PKG_VERSION" | |
| exit 1 | |
| fi | |
| if [ "$JSR_VERSION" != "$VERSION" ]; then | |
| echo "ERROR: Tag does not match versions!" | |
| echo " tag : $TAG" | |
| echo " jsr.json : $JSR_VERSION" | |
| echo " package.json : $PKG_VERSION" | |
| exit 1 | |
| fi | |
| echo "is_tag_push=true" >> "$GITHUB_OUTPUT" | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| else | |
| if [ ! -f "jsr.json" ]; then | |
| echo "ERROR: jsr.json not found" | |
| exit 1 | |
| fi | |
| if [ ! -f "package.json" ]; then | |
| echo "ERROR: package.json not found" | |
| exit 1 | |
| fi | |
| JSR_VERSION="$(jq -r '.version // empty' jsr.json)" | |
| PKG_VERSION="$(jq -r '.version // empty' package.json)" | |
| if [ -z "$JSR_VERSION" ] || [ -z "$PKG_VERSION" ]; then | |
| echo "ERROR: Missing version in jsr.json or package.json" | |
| exit 1 | |
| fi | |
| if [ "$JSR_VERSION" != "$PKG_VERSION" ]; then | |
| echo "ERROR: Version mismatch!" | |
| echo " jsr.json : $JSR_VERSION" | |
| echo " package.json : $PKG_VERSION" | |
| exit 1 | |
| fi | |
| echo "is_tag_push=false" >> "$GITHUB_OUTPUT" | |
| echo "tag=v$JSR_VERSION" >> "$GITHUB_OUTPUT" | |
| echo "version=$JSR_VERSION" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Check if tag exists | |
| id: exists | |
| if: steps.meta.outputs.is_tag_push == 'false' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| TAG="${{ steps.meta.outputs.tag }}" | |
| git fetch --tags | |
| if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then | |
| echo "exists=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "exists=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Export job outputs | |
| id: out | |
| shell: bash | |
| env: | |
| IS_TAG_PUSH: ${{ steps.meta.outputs.is_tag_push }} | |
| TAG: ${{ steps.meta.outputs.tag }} | |
| VERSION: ${{ steps.meta.outputs.version }} | |
| EXISTS: ${{ steps.exists.outputs.exists }} | |
| run: | | |
| set -euo pipefail | |
| if [ "$IS_TAG_PUSH" = "true" ]; then | |
| RUN="true" | |
| CREATE_TAG="false" | |
| else | |
| if [ "${EXISTS:-false}" = "false" ]; then | |
| RUN="true" | |
| CREATE_TAG="true" | |
| else | |
| RUN="false" | |
| CREATE_TAG="false" | |
| fi | |
| fi | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| echo "run=$RUN" >> "$GITHUB_OUTPUT" | |
| echo "create_tag=$CREATE_TAG" >> "$GITHUB_OUTPUT" | |
| ci: | |
| if: github.repository == 'kasperrt/wiretyped' && needs.detect.outputs.run == 'true' | |
| needs: [detect] | |
| uses: ./.github/workflows/ci.yml | |
| tag: | |
| if: github.repository == 'kasperrt/wiretyped' && needs.detect.outputs.run == 'true' && needs.ci.result == 'success' | |
| needs: [detect, ci] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check if tag exists | |
| id: exists | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| TAG="${{ needs.detect.outputs.tag }}" | |
| git fetch --tags | |
| if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then | |
| echo "exists=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "exists=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Create and push tag | |
| if: needs.detect.outputs.create_tag == 'true' && steps.exists.outputs.exists == 'false' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| TAG="${{ needs.detect.outputs.tag }}" | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git tag -a "$TAG" -m "Release $TAG" | |
| git push origin "$TAG" | |
| release: | |
| if: github.repository == 'kasperrt/wiretyped' && needs.detect.outputs.run == 'true' && needs.ci.result == 'success' && needs.tag.result == 'success' | |
| needs: [detect, ci, tag] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Checkout tag | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| TAG="${{ needs.detect.outputs.tag }}" | |
| git fetch --tags | |
| git checkout "$TAG" | |
| - name: Validate versions match tag | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| JSR_VERSION="$(jq -r '.version // empty' jsr.json)" | |
| PKG_VERSION="$(jq -r '.version // empty' package.json)" | |
| if [ -z "$JSR_VERSION" ] || [ -z "$PKG_VERSION" ]; then | |
| echo "ERROR: Missing version in jsr.json or package.json" | |
| exit 1 | |
| fi | |
| if [ "$JSR_VERSION" != "$PKG_VERSION" ]; then | |
| echo "ERROR: Version mismatch!" | |
| echo " jsr.json : $JSR_VERSION" | |
| echo " package.json : $PKG_VERSION" | |
| exit 1 | |
| fi | |
| EXPECTED="v$JSR_VERSION" | |
| TAG="${{ needs.detect.outputs.tag }}" | |
| if [ "$TAG" != "$EXPECTED" ]; then | |
| echo "ERROR: Tag does not match versions!" | |
| echo " tag : $TAG" | |
| echo " expected tag : $EXPECTED" | |
| exit 1 | |
| fi | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 11.1.2 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 25 | |
| registry-url: "https://registry.npmjs.org" | |
| cache: "pnpm" | |
| - name: Download dist artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: dist-build | |
| path: dist | |
| - name: Determine npm dist-tag | |
| id: npm_tag | |
| env: | |
| VERSION: ${{ needs.detect.outputs.version }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [[ "$VERSION" == *-* ]]; then | |
| TAG="next" | |
| echo "Detected prerelease version ($VERSION); using dist-tag '$TAG'" | |
| else | |
| TAG="latest" | |
| echo "Detected stable version ($VERSION); using dist-tag '$TAG'" | |
| fi | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Publish to npm | |
| env: | |
| VERSION: ${{ steps.npm_tag.outputs.version }} | |
| TAG: ${{ steps.npm_tag.outputs.tag }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| PACKAGE="wiretyped" | |
| if npm view "${PACKAGE}@${VERSION}" version >/dev/null 2>&1; then | |
| echo "Package ${PACKAGE}@${VERSION} already exists in the registry. Skipping publish." | |
| else | |
| echo "Publishing ${PACKAGE}@${VERSION}..." | |
| npm publish --tag "$TAG" | |
| fi | |
| - name: Publish to JSR | |
| run: pnpx jsr publish |