fix: name the credential behind an auth failure, and say where render… #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: ['v*'] | |
| permissions: | |
| contents: read | |
| id-token: write | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # No `version:` here on purpose — pnpm/action-setup@v4 refuses to run when | |
| # the version is pinned both here and in package.json's packageManager, | |
| # which is the single source of truth. | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: pnpm | |
| registry-url: https://registry.npmjs.org | |
| - run: pnpm install --frozen-lockfile | |
| - name: Verify the tag matches package.json | |
| run: | | |
| TAG="${GITHUB_REF_NAME#v}" | |
| PKG=$(node -p "require('./package.json').version") | |
| test "$TAG" = "$PKG" || { echo "Tag $TAG != package.json $PKG"; exit 1; } | |
| - run: node scripts/sync-version.mjs --check | |
| - run: pnpm typecheck | |
| - run: pnpm lint | |
| - run: pnpm test:unit | |
| - run: pnpm test:integration | |
| - run: pnpm build | |
| - run: pnpm test:e2e | |
| # A version already on npm is not a failure: the tag may have been pushed | |
| # after a manual publish, or re-pushed to rerun the checks. Publishing is | |
| # the only step here that cannot be repeated, so it is the only one that | |
| # needs the guard. | |
| - name: Check whether this version is already published | |
| id: published | |
| run: | | |
| NAME=$(node -p "require('./package.json').name") | |
| VERSION=$(node -p "require('./package.json').version") | |
| if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then | |
| echo "already=true" >> "$GITHUB_OUTPUT" | |
| echo "$NAME@$VERSION is already on npm — skipping publish." | |
| else | |
| echo "already=false" >> "$GITHUB_OUTPUT" | |
| echo "$NAME@$VERSION is not on npm yet." | |
| fi | |
| - name: Publish to npm | |
| if: steps.published.outputs.already == 'false' | |
| run: | | |
| if [ -z "$NODE_AUTH_TOKEN" ]; then | |
| echo "::error::NPM_TOKEN is not configured, so this release cannot be published." | |
| echo "Create an Automation token at npmjs.com and add it with:" | |
| echo " gh secret set NPM_TOKEN -R ${{ github.repository }}" | |
| exit 1 | |
| fi | |
| pnpm publish --access public --no-git-checks --provenance | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} |