Skip to content

Commit 7af5876

Browse files
AndaristAndarist
authored
Restrict publish job to the npm env (#1972)
* Restrict `publish` workflow to the `npm` env * split version and publish * simplify one thing
1 parent ff767d2 commit 7af5876

1 file changed

Lines changed: 26 additions & 118 deletions

File tree

‎.github/workflows/publish.yml‎

Lines changed: 26 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -5,144 +5,52 @@ on:
55
branches:
66
- main
77
- next
8-
issue_comment:
9-
types: [created]
108

11-
concurrency: ${{ github.workflow }}-${{ github.event_name == 'issue_comment' && github.event.issue.number || github.ref }}
9+
concurrency: ${{ github.workflow }}-${{ github.ref }}
1210

1311
permissions: {} # each job should define its own permission explicitly
1412

1513
jobs:
16-
publish:
17-
name: Publish
18-
if: github.repository == 'changesets/changesets' && github.event_name == 'push'
14+
version:
15+
name: Version
1916
runs-on: ubuntu-latest
2017
timeout-minutes: 20
18+
outputs:
19+
hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
2120
permissions:
2221
contents: write # to create release (changesets/action)
2322
issues: write # to post issue comments (changesets/action)
2423
pull-requests: write # to create pull request (changesets/action)
24+
steps:
25+
- uses: actions/checkout@v4
26+
- uses: ./.github/actions/ci-setup
27+
28+
- name: Create or update release pull request
29+
id: changesets
30+
# https://github.com/changesets/action
31+
uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1
32+
with:
33+
version: yarn version-packages
34+
35+
publish:
36+
name: Publish
37+
if: needs.version.outputs.hasChangesets == 'false'
38+
needs: version
39+
runs-on: ubuntu-latest
40+
environment: npm
41+
timeout-minutes: 20
42+
permissions:
43+
contents: write # to create release (changesets/action)
2544
id-token: write # to use OpenID Connect token for trusted publishing (changesets/action)
2645
steps:
2746
- uses: actions/checkout@v4
2847
- uses: ./.github/actions/ci-setup
2948
with:
3049
node-version: 24
3150

32-
- name: Create Release Pull Request or Publish to npm
51+
- name: Publish to npm
3352
# https://github.com/changesets/action
3453
uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1
3554
with:
3655
# this expects you to have a script called release which does a build for your packages and calls changeset publish
3756
publish: yarn release
38-
version: yarn version-packages
39-
40-
# publish_pr:
41-
# if: github.repository == 'changesets/changesets' && github.event_name == 'issue_comment' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/publish-pr')
42-
# timeout-minutes: 20
43-
# runs-on: ubuntu-latest
44-
# permissions:
45-
# contents: read # to checkout the pull request
46-
# id-token: write # to use OpenID Connect token for trusted publishing
47-
# issues: write # to post comments and reactions
48-
# pull-requests: write # to post reactions on PR comments
49-
# steps:
50-
# - name: Report in-progress reaction
51-
# id: report_in_progress
52-
# run: |
53-
# REACTION_ID=$(gh api /repos/${{github.repository}}/issues/comments/${{github.event.comment.id}}/reactions -f content='eyes' --jq '.id')
54-
# echo "in_progress_reaction_id=$REACTION_ID" >> "$GITHUB_OUTPUT"
55-
# env:
56-
# GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
57-
58-
# - name: Check if user is authorized to publish
59-
# id: check_authorization
60-
# run: |
61-
# if [[ $AUTHOR_ASSOCIATION == 'MEMBER' || $AUTHOR_ASSOCIATION == 'OWNER' || $AUTHOR_ASSOCIATION == 'COLLABORATOR' ]]
62-
# then
63-
# echo "User is authorized to publish"
64-
# else
65-
# echo "User is not authorized to publish"
66-
# exit 1
67-
# fi
68-
# env:
69-
# AUTHOR_ASSOCIATION: ${{ github.event.comment.author_association }}
70-
71-
# - uses: actions/checkout@v4
72-
73-
# - name: Checkout pull request
74-
# run: gh pr checkout ${{ github.event.issue.number }}
75-
# env:
76-
# GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
77-
78-
# - name: Check if Version Packages PR
79-
# id: check_version_packages
80-
# run: |
81-
# IS_VERSION_PACKAGES_PR=$(gh pr view ${{ github.event.issue.number }} --json headRefName --jq '.headRefName|startswith("changeset-release/")')
82-
# echo "is_version_packages_pr=$IS_VERSION_PACKAGES_PR" >> "$GITHUB_OUTPUT"
83-
# env:
84-
# GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
85-
86-
# # for Version Packages PR we want to publish the state from before the Version Packages commit
87-
# - name: Reset Version Packages PR
88-
# if: steps.check_version_packages.outputs.is_version_packages_pr == 'true'
89-
# run: git reset --hard HEAD~1
90-
91-
# - uses: ./.github/actions/ci-setup
92-
# with:
93-
# node-version: 24
94-
95-
# - name: Compute snapshot version
96-
# id: snapshot_version
97-
# run: |
98-
# PUBLISH_TAG="pr${{ github.event.issue.number }}"
99-
# SNAPSHOT_TAG="${PUBLISH_TAG}.$(git rev-parse --short HEAD)"
100-
101-
# echo "publish_tag=$PUBLISH_TAG" >> "$GITHUB_OUTPUT"
102-
# echo "snapshot_tag=$SNAPSHOT_TAG" >> "$GITHUB_OUTPUT"
103-
# echo "version=0.0.0-$SNAPSHOT_TAG" >> "$GITHUB_OUTPUT"
104-
105-
# - run: yarn changeset version --snapshot "${{ steps.snapshot_version.outputs.snapshot_tag }}" --snapshot-prerelease-template "{tag}"
106-
# env:
107-
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
108-
109-
# - run: yarn build
110-
111-
# - name: Publish snapshot versions
112-
# run: yarn changeset publish --tag "${{ steps.snapshot_version.outputs.publish_tag }}"
113-
114-
# - name: Post comment with published version
115-
# run: |
116-
# cat <<'BODY' > /tmp/comment-body.md
117-
# Published snapshot version `${{ steps.snapshot_version.outputs.version }}` in response to [this comment](${{ github.event.comment.html_url }}).
118-
# BODY
119-
# gh issue comment "${{ github.event.issue.number }}" --body-file /tmp/comment-body.md
120-
# env:
121-
# GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
122-
123-
# - name: Post failure comment
124-
# if: failure()
125-
# run: |
126-
# FAILED_JOB_ID=$(gh api "/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs" --jq ".jobs[] | select(.name == \"$GITHUB_JOB\") | .id")
127-
# LINK="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}/job/${FAILED_JOB_ID}"
128-
129-
# cat <<BODY > /tmp/comment-body.md
130-
# Snapshot publish triggered by [this comment](${{ github.event.comment.html_url }}) failed. [See the failed job](${LINK}).
131-
# BODY
132-
# gh issue comment "${{ github.event.issue.number }}" --body-file /tmp/comment-body.md
133-
# env:
134-
# GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
135-
136-
# - name: Add result reaction
137-
# if: always() && steps.report_in_progress.outcome == 'success'
138-
# run: |
139-
# gh api /repos/${{github.repository}}/issues/comments/${{github.event.comment.id}}/reactions \
140-
# -f content="${{ job.status == 'success' && 'rocket' || '-1' }}"
141-
# env:
142-
# GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
143-
144-
# - name: Remove in-progress reaction
145-
# if: always() && steps.report_in_progress.outcome == 'success'
146-
# run: gh api -X DELETE /repos/${{github.repository}}/issues/comments/${{github.event.comment.id}}/reactions/${{steps.report_in_progress.outputs.in_progress_reaction_id}}
147-
# env:
148-
# GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)