From 62fb85a16ef454e758fc0e42240e6601dce26ac1 Mon Sep 17 00:00:00 2001 From: Arun Tyagi Date: Tue, 11 Aug 2026 16:20:54 +0530 Subject: [PATCH] Add publish-to-npm-lite workflow for code-analyzer-lite releases GitHub Actions only discovers release/workflow_dispatch triggers from workflows present on the default branch, so this workflow needs to land on dev even though the codeanalyzer-lite branch it publishes from lives separately. The workflow checks out the release tag itself to build and publish, so it pulls in the lite package's actual source regardless of which branch dev is on. --- .github/workflows/publish-to-npm-lite.yml | 132 ++++++++++++++++++++++ 1 file changed, 132 insertions(+) create mode 100644 .github/workflows/publish-to-npm-lite.yml diff --git a/.github/workflows/publish-to-npm-lite.yml b/.github/workflows/publish-to-npm-lite.yml new file mode 100644 index 000000000..2ee70d4df --- /dev/null +++ b/.github/workflows/publish-to-npm-lite.yml @@ -0,0 +1,132 @@ +name: publish-to-npm-lite +on: + release: + types: [released] + # Support manual releases in case something goes wrong, or we need to do a test. + workflow_dispatch: + inputs: + tag: + description: Tag to be published + type: string + required: true + +jobs: + # Step 1: Verify that the tag we're trying to release is a valid candidate for publishing. + verify-candidate-tag: + runs-on: ubuntu-latest + steps: + # Checkout the tag we want to release. + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.release.tag_name || inputs.tag }} + # Verify that the `package.json`'s name property is the lite package, so this workflow can't accidentally + # publish a tag intended for the full plugin (or vice versa). + - name: Verify package name + run: | + PACKAGE_NAME=$(jq -r ".name" package.json) + [[ ${PACKAGE_NAME} == "@salesforce/plugin-code-analyzer-lite" ]] || (echo "package.json name must be @salesforce/plugin-code-analyzer-lite" && exit 1) + # Verify that the `package.json`'s version property is 5.Y.Z, as we want to restrict this branch to + # publishing v5.x, matching the full plugin's major version. + - name: Verify major version + run: | + MAJOR_VERSION=`cat package.json | jq '.version | split(".") | .[0]' | xargs` + [[ ${MAJOR_VERSION} == 5 ]] || (echo "package.json version must be 5.x" && exit 1) + # Verify that the tag is of the format "vX.Y.Z", where the X, Y, and Z exactly match the corresponding values in + # `package.json`'s version property. Tag/input values are compared as environment variables (not interpolated + # directly into the script) to avoid shell injection via a crafted tag name. + - name: Compare tag to package.json + env: + GIT_TAG: ${{ github.event.release.tag_name || inputs.tag }} + run: | + PACKAGE_VERSION=v`cat package.json | jq '.version' | xargs` + [[ "${GIT_TAG}" == "${PACKAGE_VERSION}" ]] || (echo "Tag name must match package.json version, prefixed by lowercase v" && exit 1) + - name: Check if this version number is already used on NPM + run: | + RESPONSE=$(npm view @salesforce/plugin-code-analyzer-lite@$INPUTS_GITHUB_TAG version --json --silent || echo "Not published") + if [ "$RESPONSE" = "\"$INPUTS_GITHUB_TAG\"" ]; then + echo "NPM already has a package with this version number, so publishing is impossible." && exit 1 + else + echo "NPM does not yet have a package with this version number, so we're free to use it here." + fi + env: + INPUTS_GITHUB_TAG: ${{ github.event.release.tag_name || inputs.tag }} + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + # Step 2: Publish the tag as a release candidate. + publish-rc: + needs: verify-candidate-tag + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.release.tag_name || inputs.tag }} + - uses: actions/setup-node@v4 + with: + node-version: 'lts/*' + - run: npm install && npm run build + - run: npm install -g @salesforce/plugin-release-management + - name: NPM release + run: | + sf-release npm:package:release \ + --githubtag "$INPUTS_GITHUB_TAG" \ + --npmtag "$INPUTS_NPM_TAG" \ + --no-install \ + --sign + env: + INPUTS_GITHUB_TAG: ${{ github.event.release.tag_name || inputs.tag }} + INPUTS_NPM_TAG: latest-rc # Publish as a release candidate, so we can do our validations against it. + AWS_ACCESS_KEY_ID: ${{secrets.AWS_ACCESS_KEY_ID}} + AWS_SECRET_ACCESS_KEY: ${{secrets.AWS_SECRET_ACCESS_KEY}} + NPM_TOKEN: ${{secrets.NPM_TOKEN}} + # Step 3: Run smoke tests against the release candidate. + rc-test: + needs: publish-rc + strategy: + # By default, if any job in a matrix fails, all other jobs are immediately cancelled. This option makes the jobs + # run to completion instead. + fail-fast: false + matrix: + os: [{vm: ubuntu-latest, exe: .sh}, {vm: macos-latest, exe: .sh}, {vm: windows-latest, exe: .cmd}] + runs-on: ${{ matrix.os.vm }} + steps: + # We need to checkout the tag to get the smoke tests + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.release.tag_name || inputs.tag }} + # We need Node LTS and Java v11 + - uses: actions/setup-node@v4 + with: + node-version: 'lts/*' + - uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '11' # For now, Java version is hardcoded. + - uses: actions/setup-python@v5 + with: + python-version: '>=3.10' + # Install SF, and the release candidate version. + - run: npm install -g @salesforce/cli + - run: sf plugins install @salesforce/plugin-code-analyzer-lite@latest-rc + # Log the installed plugins for easier debugging. + - run: sf plugins + # Attempt to run the smoke tests. + - run: smoke-tests/smoke-test${{ matrix.os.exe }} sf + # Upload the smoke test result as an artifact, so it's visible for later. + - uses: actions/upload-artifact@v4 + if: ${{ always() }} + with: + name: ${{ runner.os }}-smoke-test-results-lite + path: smoke-test-results + # Step 4: Promote the release candidate to latest. + promote-to-latest: + needs: rc-test + runs-on: ubuntu-latest + steps: + - uses: actions/setup-node@v4 + with: + node-version: 'lts/*' + - env: + NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + GIT_TAG: ${{ github.event.release.tag_name || inputs.tag }} + run: | + echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc + npm dist-tag add "@salesforce/plugin-code-analyzer-lite@${GIT_TAG}" latest