core/.github/workflows/release-npm.yml at main · ReactUnity/core · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
name: Release npm packages

# `tegami ci` versions when pending .tegami/*.md changelogs exist (opening a
# "Version Packages" PR via the github plugin), otherwise it publishes from the
# committed .tegami/publish-lock.yaml.
#
# Replaces the hand-rolled `npm version --workspaces` script and the manual
# release ordering the old README documented (scripts -> renderer -> material ->
# injectable/devtools/quick-start -> core -> ...). Tegami derives that order from
# the workspace graph.
#
# Only packages/* publish. unity/* are UPM packages -- see release-upm.yml. The
# five private packages are excluded in scripts/tegami.mts.
#
# NOTE the filename: npm's trusted publishers point at `release-npm.yml`.
# Renaming this file breaks publishing until they are all updated.
on:
  push:
    branches: [main]
  workflow_dispatch:

# No paths filter, deliberately. `tegami ci` is a safe no-op when there are no
# pending changelogs and no publish lock, so running it on every push to main
# costs one short job and cannot miss a release the way a filter can.
concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: write # commit version bumps, push the Version Packages branch
  id-token: write # npm trusted publishing (OIDC) - no NPM_TOKEN needed
  pull-requests: write # open the Version Packages PR

jobs:
  release:
    name: Version & publish
    runs-on: ubuntu-latest
    outputs:
      published: ${{ steps.tegami.outputs.published }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .node-version
          cache: pnpm
          registry-url: https://registry.npmjs.org

      - run: pnpm install --frozen-lockfile

      # Explicit build before publishing. `pnpm publish` does run each package's
      # prepack/prepare, but material's build needs renderer's dist to exist
      # first, and only `pnpm build` guarantees topological order.
      - run: pnpm build

      # Publishes via npm trusted publishing (OIDC) - no NPM_TOKEN anywhere.
      #
      # Note WHICH tool publishes: with npm.client 'pnpm', Tegami runs
      # `pnpm publish --no-git-checks` (tegami 1.2.6, dist/npm-*.js:1180). So
      # npm's documented ">= 11.5.1 for OIDC" is not the binding constraint --
      # pnpm's own OIDC support is. Setting npm.client to 'npm' in
      # scripts/tegami.mts switches to `npm publish` if that ever regresses.
      #
      # Requirements, each of which fails as a bare 404:
      #   - pnpm past the 11.0.8 OIDC regression (pnpm/pnpm#11513, fixed by
      #     #11526). packageManager pins 11.17.0, well past it.
      #   - a Trusted Publisher on npmjs.com for EACH of the four packages,
      #     naming this repo and the workflow filename `release-npm.yml`.
      #   - each package's `repository` field pointing at this repo, or the
      #     provenance attestation disagrees with the manifest.
      #
      # The tag diff is how the UPM job below learns whether this run published
      # or merely opened a Version PR. Tegami tags reactunity@<version> only when
      # it publishes, so a tag appearing across this step is the signal. Testing
      # whether the tag merely *exists* would read true on every later push to
      # main too, and re-run the UPM job for nothing.
      - id: tegami
        run: |
          set -euo pipefail
          before=$(git tag -l 'reactunity@*')
          pnpm tegami ci
          after=$(git tag -l 'reactunity@*')
          if [ "$before" = "$after" ]; then
            echo 'published=false' >> "$GITHUB_OUTPUT"
          else
            echo 'published=true' >> "$GITHUB_OUTPUT"
          fi
        env:
          GITHUB_TOKEN: ${{ github.token }}

  # Ship the four Unity packages at the same version, in the same run.
  #
  # `uses:` rather than a `release: published` trigger on release-upm.yml, or a
  # `gh workflow run` dispatch from here: Tegami creates the GitHub release with
  # GITHUB_TOKEN, and events from that token do not start new workflow runs. A
  # reusable-workflow call runs inside this one, so the rule never applies.
  upm:
    name: Publish UPM packages
    needs: release
    if: needs.release.outputs.published == 'true'
    permissions:
      contents: write
    uses: ./.github/workflows/release-upm.yml
    with:
      package: all