@@ -3,145 +3,145 @@ name: Publish NPM Package
33
44# When this workflow triggers
55on :
6- # Only when a release is published
7- release :
8- types : [released]
6+ # Only when a release is published
7+ release :
8+ types : [released]
99
1010# Define each session of execution that should be executed
1111jobs :
12- # Ensure that there are no obvious bugs before deploying
13- Test-Unit :
14- # Display name of the job
15- name : Unit Test Project
16-
17- # Sets the scopes available to the github_token injected to the GH Actions runner
18- permissions :
19- contents : read
20-
21- # Execute the workflow
22- uses : ./.github/workflows/Test-Unit.yml
23-
24- # Ensure that our code standards are met before deploying
25- Test-Lint :
26- # Display name of the job
27- name : Lint Project
28-
29- # Sets the scopes available to the github_token injected to the GH Actions runner
30- permissions :
31- contents : read
32-
33- # Execute the workflow
34- uses : ./.github/workflows/Test-Lint.yml
35-
36- # Execution session that builds and runs tests/linting on the code one more time
37- Build-Artifact :
38- # Display name of the job
39- name : Build Artifact
40-
41- # Configures the filter for which operating system that should be used when selecting runners
42- runs-on : ubuntu-latest
43-
44- # Require the test step to complete before creating the artifact
45- needs : [Test-Unit, Test-Lint]
46-
47- # Sets the scopes available to the github_token injected to the GH Actions runner
48- permissions :
49- attestations : write
50- contents : read
51- id-token : write
52-
53- # Set of commands to run for the build job
54- steps :
55- # Checks-out the repository under $GITHUB_WORKSPACE
56- - name : Clone Repo
57- uses : actions/checkout@v5
58-
59- # Set up NodeJS on the build host with caching support to optimize execution
60- - name : Setup Node.JS Runtime
61- uses : actions/setup-node@v6
62- with :
63- node-version : 22
64- cache : npm
65- cache-dependency-path : package-lock.json
66-
67- # Install all of the dependencies
68- - name : Install All of the Project Dependencies
69- run : npm install
70-
71- # Compile the Typescript files to JS
72- - name : Build Project
73- run : npm run-script build:Prod
74-
75- # Create a ZIP archive of the server files to speed up the upload process
76- - name : Zip up Server Files
77- run : zip -r package.zip bin/ config/baseTsConfig.json LICENSE README.md package.json
78-
79- # Create an attestation for the compiled package and upload it to the internal system for health tracking
80- - name : Attest Compiled Package
81- uses : actions/attest-build-provenance@v3
82- with :
83- subject-path : package.zip
84-
85- # Upload compiled zip file so that other execution sessions can use it
86- - name : Upload Artifact for Deployment Job
87- uses : actions/upload-artifact@v4
88- with :
89- compression-level : 9
90- if-no-files-found : error
91- name : Development-Utilities
92- path : package.zip
93- retention-days : 1
94-
95- # Execution Session that deploys the artifact to NPM
96- Deploy-NPM :
97- # Display name of the job
98- name : Deploy to NPM
99-
100- # Configures the filter for which operating system that should be used when selecting runners
101- runs-on : ubuntu-latest
102-
103- # Require the build step to complete before running the deployment
104- needs : Build-Artifact
105-
106- # Sets the scopes available to the github_token injected to the GH Actions runner
107- permissions :
108- attestations : read
109- contents : none
110- id-token : write
111-
112- # The deploy step runs in the Azure environment context
113- environment : NPM-OIDC
114-
115- # Set of commands to run for the build job
116- steps :
117- # Set up NodeJS on the build host with caching support to optimize execution
118- - name : Set up Node.JS Runtime
119- uses : actions/setup-node@v6
120- with :
121- node-version : 22
122- registry-url : https://registry.npmjs.org
123- scope : shi-corp
124-
125- # Update the NPM CLI to the latest available version
126- - name : Update NPM CLI
127- run : npm install -g npm
128-
129- # Download the compiled server binary
130- - name : Download Artifact From Build Job
131- uses : actions/download-artifact@v5
132- with :
133- name : Development-Utilities
134-
135- # Validate the attestation of the downloaded artifact to prevent tamper
136- - name : Validate Attestation
137- env :
138- GH_TOKEN : ${{secrets.GITHUB_TOKEN}}
139- run : gh attestation verify package.zip --repo Software-Hardware-Integration-Lab/Development-Utilities --signer-workflow Software-Hardware-Integration-Lab/Development-Utilities/.github/workflows/Deploy.yml@refs/tags/${GITHUB_REF#refs/tags/}
140-
141- # Extract the zip file and remove the container
142- - name : Unzip Artifact
143- run : unzip package.zip && rm package.zip
144-
145- # Publish the artifact to NPM with attestation
146- - name : Upload Package to NPM Registry
147- run : npm publish
12+ # Ensure that there are no obvious bugs before deploying
13+ Test-Unit :
14+ # Display name of the job
15+ name : Unit Test Project
16+
17+ # Sets the scopes available to the github_token injected to the GH Actions runner
18+ permissions :
19+ contents : read
20+
21+ # Execute the workflow
22+ uses : ./.github/workflows/Test-Unit.yml
23+
24+ # Ensure that our code standards are met before deploying
25+ Test-Lint :
26+ # Display name of the job
27+ name : Lint Project
28+
29+ # Sets the scopes available to the github_token injected to the GH Actions runner
30+ permissions :
31+ contents : read
32+
33+ # Execute the workflow
34+ uses : ./.github/workflows/Test-Lint.yml
35+
36+ # Execution session that builds and runs tests/linting on the code one more time
37+ Build-Artifact :
38+ # Display name of the job
39+ name : Build Artifact
40+
41+ # Configures the filter for which operating system that should be used when selecting runners
42+ runs-on : ubuntu-latest
43+
44+ # Require the test step to complete before creating the artifact
45+ needs : [Test-Unit, Test-Lint]
46+
47+ # Sets the scopes available to the github_token injected to the GH Actions runner
48+ permissions :
49+ attestations : write
50+ contents : read
51+ id-token : write
52+
53+ # Set of commands to run for the build job
54+ steps :
55+ # Checks-out the repository under $GITHUB_WORKSPACE
56+ - name : Clone Repo
57+ uses : actions/checkout@v5
58+
59+ # Set up NodeJS on the build host with caching support to optimize execution
60+ - name : Setup Node.JS Runtime
61+ uses : actions/setup-node@v6
62+ with :
63+ node-version : 22
64+ cache : npm
65+ cache-dependency-path : package-lock.json
66+
67+ # Install all of the dependencies
68+ - name : Install All of the Project Dependencies
69+ run : npm install
70+
71+ # Compile the Typescript files to JS
72+ - name : Build Project
73+ run : npm run-script build:Prod
74+
75+ # Create a ZIP archive of the server files to speed up the upload process
76+ - name : Zip up Server Files
77+ run : zip -r package.zip bin/ config/typescript/ LICENSE README.md package.json
78+
79+ # Create an attestation for the compiled package and upload it to the internal system for health tracking
80+ - name : Attest Compiled Package
81+ uses : actions/attest-build-provenance@v3
82+ with :
83+ subject-path : package.zip
84+
85+ # Upload compiled zip file so that other execution sessions can use it
86+ - name : Upload Artifact for Deployment Job
87+ uses : actions/upload-artifact@v4
88+ with :
89+ compression-level : 9
90+ if-no-files-found : error
91+ name : Development-Utilities
92+ path : package.zip
93+ retention-days : 1
94+
95+ # Execution Session that deploys the artifact to NPM
96+ Deploy-NPM :
97+ # Display name of the job
98+ name : Deploy to NPM
99+
100+ # Configures the filter for which operating system that should be used when selecting runners
101+ runs-on : ubuntu-latest
102+
103+ # Require the build step to complete before running the deployment
104+ needs : Build-Artifact
105+
106+ # Sets the scopes available to the github_token injected to the GH Actions runner
107+ permissions :
108+ attestations : read
109+ contents : none
110+ id-token : write
111+
112+ # The deploy step runs in the Azure environment context
113+ environment : NPM-OIDC
114+
115+ # Set of commands to run for the build job
116+ steps :
117+ # Set up NodeJS on the build host with caching support to optimize execution
118+ - name : Set up Node.JS Runtime
119+ uses : actions/setup-node@v6
120+ with :
121+ node-version : 22
122+ registry-url : https://registry.npmjs.org
123+ scope : shi-corp
124+
125+ # Update the NPM CLI to the latest available version
126+ - name : Update NPM CLI
127+ run : npm install -g npm
128+
129+ # Download the compiled server binary
130+ - name : Download Artifact From Build Job
131+ uses : actions/download-artifact@v5
132+ with :
133+ name : Development-Utilities
134+
135+ # Validate the attestation of the downloaded artifact to prevent tamper
136+ - name : Validate Attestation
137+ env :
138+ GH_TOKEN : ${{secrets.GITHUB_TOKEN}}
139+ run : gh attestation verify package.zip --repo Software-Hardware-Integration-Lab/Development-Utilities --signer-workflow Software-Hardware-Integration-Lab/Development-Utilities/.github/workflows/Deploy.yml@refs/tags/${GITHUB_REF#refs/tags/}
140+
141+ # Extract the zip file and remove the container
142+ - name : Unzip Artifact
143+ run : unzip package.zip && rm package.zip
144+
145+ # Publish the artifact to NPM with attestation
146+ - name : Upload Package to NPM Registry
147+ run : npm publish
0 commit comments