Merge pull request #12 from trieb-work/changeset-release/main #19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| concurrency: | |
| group: release-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| id-token: write | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@v5 | |
| - name: Use Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| registry-url: "https://registry.npmjs.org" | |
| always-auth: true | |
| - name: Install dependencies (no install scripts) | |
| # Hardening: NPM_TOKEN is exposed in this job. Block all postinstall | |
| # scripts from third-party deps and only rebuild the approved allowlist | |
| # in pnpm.onlyBuiltDependencies. The repo's own `prepare` script is | |
| # also skipped (build runs explicitly via `pnpm run release`). | |
| run: pnpm install --frozen-lockfile --ignore-scripts | |
| - name: Rebuild approved native deps | |
| run: pnpm rebuild | |
| - name: Create release PR or publish to npm | |
| uses: changesets/action@v1.7.0 | |
| with: | |
| version: pnpm changeset version | |
| commit: "chore(release): version packages" | |
| title: "chore: release new version" | |
| publish: pnpm run release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| NPM_CONFIG_PROVENANCE: "true" |