|
| 1 | +name: Publish Packages |
| 2 | + |
| 3 | +# This workflow publishes packages to npm when changes are merged to main branch or when manually triggered. |
| 4 | + |
| 5 | +on: |
| 6 | + push: |
| 7 | + paths: |
| 8 | + - 'packages/*/package.json' |
| 9 | + # For security reasons, this should never be set to anything but `main` |
| 10 | + branches: [main] |
| 11 | + workflow_dispatch: |
| 12 | + inputs: |
| 13 | + package: |
| 14 | + description: 'Specific package to publish (leave empty for all packages)' |
| 15 | + required: false |
| 16 | + type: string |
| 17 | + |
| 18 | +permissions: |
| 19 | + contents: read |
| 20 | + |
| 21 | +concurrency: |
| 22 | + group: ${{ github.workflow }}-${{ github.ref }} |
| 23 | + cancel-in-progress: false |
| 24 | + |
| 25 | +env: |
| 26 | + COMMIT_SHA: ${{ github.sha }} |
| 27 | + |
| 28 | +jobs: |
| 29 | + prepare-packages: |
| 30 | + name: Prepare Packages |
| 31 | + runs-on: ubuntu-latest |
| 32 | + outputs: |
| 33 | + # Output the matrix of packages to publish for use in the publish job |
| 34 | + matrix: ${{ steps.generate-matrix.outputs.matrix }} |
| 35 | + steps: |
| 36 | + - name: Harden Runner |
| 37 | + uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0 |
| 38 | + with: |
| 39 | + egress-policy: audit |
| 40 | + |
| 41 | + - name: Verify commit authenticity |
| 42 | + env: |
| 43 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 44 | + run: | |
| 45 | + # Get commit data from GitHub API to verify its authenticity |
| 46 | + COMMIT_DATA=$(gh api repos/${{ github.repository }}/commits/$COMMIT_SHA) |
| 47 | + # Check if commit signature is verified (GPG signed) |
| 48 | + VERIFIED=$(echo "$COMMIT_DATA" | jq -r '.commit.verification.verified') |
| 49 | + # Check if commit was made through GitHub's web interface (merge queue) |
| 50 | + COMMITTER=$(echo "$COMMIT_DATA" | jq -r '.commit.committer.email') |
| 51 | +
|
| 52 | + # Security checks to ensure we only publish from verified and trusted sources |
| 53 | + if [[ "$VERIFIED" != "true" ]]; then |
| 54 | + echo "❌ Unverified commit! Aborting." |
| 55 | + exit 1 |
| 56 | + fi |
| 57 | +
|
| 58 | + if [[ "$COMMITTER" != "noreply@github.com" ]]; then |
| 59 | + echo "❌ Not merged with the merge queue! Aborting." |
| 60 | + exit 1 |
| 61 | + fi |
| 62 | +
|
| 63 | + echo "✅ Commit is verified and trusted." |
| 64 | +
|
| 65 | + - name: Checkout repository |
| 66 | + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 67 | + with: |
| 68 | + fetch-depth: 2 # Need at least 2 commits to detect changes between commits |
| 69 | + persist-credentials: false |
| 70 | + |
| 71 | + - name: Generate package matrix |
| 72 | + id: generate-matrix |
| 73 | + env: |
| 74 | + PACKAGE: ${{ github.event.inputs.package }} |
| 75 | + EVENT_NAME: ${{ github.event_name }} |
| 76 | + run: | |
| 77 | + if [ -n "$PACKAGE" ]; then |
| 78 | + # If a specific package is requested via workflow_dispatch, just publish that one |
| 79 | + echo "matrix={\"package\":[\"$PACKAGE\"]}" >> $GITHUB_OUTPUT |
| 80 | + else |
| 81 | + CHANGED_PACKAGES=() |
| 82 | + for pkg in $(ls -d packages/*); do |
| 83 | + PKG_NAME=$(basename "$pkg") |
| 84 | + PKG_JSON="$pkg/package.json" |
| 85 | +
|
| 86 | + # Determine if the package has changed (or include all on manual trigger) |
| 87 | + if [ "$EVENT_NAME" == "workflow_dispatch" ] || ! git diff --quiet $COMMIT_SHA~1 $COMMIT_SHA -- "$pkg/"; then |
| 88 | + OLD_VERSION=$(git show $COMMIT_SHA~1:$PKG_JSON | jq -r '.version') |
| 89 | + NEW_VERSION=$(jq -r '.version' "$PKG_JSON") |
| 90 | + if [ "$OLD_VERSION" != "$NEW_VERSION" ]; then |
| 91 | + CHANGED_PACKAGES+=("$PKG_NAME") |
| 92 | + fi |
| 93 | + fi |
| 94 | + done |
| 95 | +
|
| 96 | + # Format the output for GitHub Actions matrix using jq |
| 97 | + PACKAGES_JSON=$(jq -n '$ARGS.positional' --args "${CHANGED_PACKAGES[@]}" -c) |
| 98 | + echo "matrix={\"package\":$PACKAGES_JSON}" >> $GITHUB_OUTPUT |
| 99 | + fi |
| 100 | +
|
| 101 | + publish: |
| 102 | + name: Publish |
| 103 | + needs: prepare-packages |
| 104 | + runs-on: ubuntu-latest |
| 105 | + permissions: |
| 106 | + # Required for npm OIDC publishing (https://docs.npmjs.com/trusted-publishers) |
| 107 | + id-token: write |
| 108 | + # Skip if no packages need to be published |
| 109 | + if: fromJson(needs.prepare-packages.outputs.matrix).package[0] != null |
| 110 | + # Use the dynamic matrix from prepare-packages job to create parallel jobs for each package |
| 111 | + strategy: |
| 112 | + matrix: ${{ fromJson(needs.prepare-packages.outputs.matrix) }} |
| 113 | + fail-fast: false # Continue publishing other packages even if one fails |
| 114 | + steps: |
| 115 | + - uses: nodejs/web-team/actions/setup-environment@9f3c83af227d721768d9dbb63009a47ed4f4282f |
| 116 | + with: |
| 117 | + pnpm: false |
| 118 | + use-version-file: true |
| 119 | + registry-url: 'https://registry.npmjs.org' |
| 120 | + |
| 121 | + - name: Publish |
| 122 | + working-directory: packages/${{ matrix.package }} |
| 123 | + run: | |
| 124 | + # Check if a custom publish script exists in package.json |
| 125 | + if jq -e '.scripts.release' package.json > /dev/null; then |
| 126 | + npm run release |
| 127 | + fi |
| 128 | +
|
| 129 | + # Then publish the package to npm |
| 130 | + npm publish --access public --no-git-checks |
| 131 | +
|
| 132 | + - name: Notify on Manual Release |
| 133 | + if: ${{ github.event_name == 'workflow_dispatch' }} |
| 134 | + uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # 2.3.3 |
| 135 | + env: |
| 136 | + SLACK_COLOR: '#43853D' |
| 137 | + SLACK_ICON: https://github.com/nodejs.png?size=48 |
| 138 | + SLACK_TITLE: ':rocket: Package Published: ${{ matrix.package }}' |
| 139 | + SLACK_MESSAGE: | |
| 140 | + :package: *Package*: `${{ matrix.package }}` (<https://www.npmjs.com/package/@node-core/${{ matrix.package }}|View on npm>) |
| 141 | + :bust_in_silhouette: *Published by*: ${{ github.triggering_actor }} |
| 142 | + :octocat: *Commit*: <https://github.com/${{ github.repository }}/commit/${{ env.COMMIT_SHA }}|${{ env.COMMIT_SHA }}> |
| 143 | + SLACK_USERNAME: nodejs-bot |
| 144 | + SLACK_CHANNEL: nodejs-web-infra |
| 145 | + SLACK_TOKEN: ${{ secrets.SLACK_TOKEN }} |
0 commit comments