ImageScript/.github/workflows/release.yml at master · matmen/ImageScript · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
name: release

# publishing a GitHub release with the tag v<version> publishes that version to npm and JSR. The tag is the version:
# the release is checked (semver, changelog, not yet on npm/JSR), tested on every supported platform, published with
# the tag's version to npm (with provenance, through trusted publishing) and JSR (through GitHub OIDC, no tokens),
# then the docs are deployed and, for regular releases, the version is committed to the default branch
on:
  release:
    types: [published]

permissions:
  contents: read

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  check:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.check.outputs.version }}
      dist-tag: ${{ steps.check.outputs.dist-tag }}
    steps:
    - uses: actions/checkout@v7
    - uses: actions/setup-node@v7
      with:
        node-version: 24.x

    - id: check
      run: node scripts/release-check.js "$TAG" "$PRERELEASE"
      env:
        TAG: ${{ github.event.release.tag_name }}
        PRERELEASE: ${{ github.event.release.prerelease }}

  test:
    needs: check
    uses: ./.github/workflows/node.yml

  publish:
    needs: [check, test]
    runs-on: ubuntu-latest
    environment:
      name: npm
      url: https://www.npmjs.com/package/imagescript?activeTab=versions
    permissions:
      contents: read
      id-token: write
    steps:
    - uses: actions/checkout@v7
    - uses: actions/setup-node@v7
      with:
        node-version: 24.x
        registry-url: https://registry.npmjs.org

    - run: npm install
    - run: node scripts/version.js "$VERSION"
      env:
        VERSION: ${{ needs.check.outputs.version }}
    # prepack builds dist; trusted publishing needs npm 11.5.1 or newer, which node 24 ships
    - run: npm publish --provenance --access public --tag "$DIST_TAG"
      env:
        DIST_TAG: ${{ needs.check.outputs.dist-tag }}

  jsr:
    needs: [check, publish]
    permissions:
      contents: read
      id-token: write
    uses: ./.github/workflows/jsr.yml
    with:
      version: ${{ needs.check.outputs.version }}

  docs:
    needs: [check, publish]
    if: needs.check.outputs.dist-tag == 'latest'
    permissions:
      contents: read
      pages: write
      id-token: write
    uses: ./.github/workflows/docs.yml
    with:
      version: ${{ needs.check.outputs.version }}

  # regular releases commit their version to the default branch (on top of what was merged since the tag), so
  # package.json there shows the latest release; prereleases and fixes for older majors leave it alone
  # (once npm has the release: a failing JSR publish can be repeated by hand, see jsr.yml)
  version:
    needs: [check, publish]
    if: needs.check.outputs.dist-tag == 'latest'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - uses: actions/checkout@v7
      with:
        ref: ${{ github.event.repository.default_branch }}
    - uses: actions/setup-node@v7
      with:
        node-version: 24.x
    - run: node scripts/version.js "$VERSION"
      env:
        VERSION: ${{ needs.check.outputs.version }}
    # pushes with GITHUB_TOKEN don't trigger other workflows
    - run: |
        if git diff --quiet; then echo "the default branch already has version $VERSION"; exit 0; fi
        git config user.name "github-actions[bot]"
        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
        git commit -am "release $VERSION"
        git push
      env:
        VERSION: ${{ needs.check.outputs.version }}