release: 0.6.1 #12
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Publishes @imbue-ai/gp-treemap to npm when a v* tag is pushed. | |
| # | |
| # To cut a release: | |
| # npm version patch -m "release: %s" # or minor / major | |
| # git push --follow-tags | |
| # | |
| # The tag push fires this workflow, which builds, publishes to npm with | |
| # provenance, and creates a GitHub Release with auto-generated notes. | |
| # | |
| # Auth: uses npm Trusted Publishing (OIDC) — no NPM_TOKEN secret needed. | |
| # The trust relationship is configured on npmjs.com under the package's | |
| # Settings → Trusted Publisher, bound to this repo + workflow file + | |
| # the "npm" GitHub environment below. If you rename this file, move | |
| # the job to a different environment, or fork the repo, update the | |
| # Trusted Publisher config to match or publishes will 404. | |
| # | |
| # id-token: write — required for OIDC token exchange with npm. | |
| # contents: write — required for softprops/action-gh-release to create the release. | |
| name: Publish to npm | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| environment: npm | |
| permissions: | |
| contents: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| registry-url: "https://registry.npmjs.org" | |
| - name: Upgrade npm for Trusted Publishing | |
| # Trusted Publishing (OIDC) requires npm >= 11.5.1; Node 20 ships | |
| # with npm 10.x, which falls back to token auth and 404s on PUT. | |
| run: npm install -g npm@latest | |
| - name: Verify tag matches package.json version | |
| run: | | |
| TAG="${GITHUB_REF#refs/tags/v}" | |
| PKG=$(node -p "require('./package.json').version") | |
| if [ "$TAG" != "$PKG" ]; then | |
| echo "Tag v$TAG does not match package.json version $PKG" >&2 | |
| exit 1 | |
| fi | |
| - name: Install dependencies | |
| run: npm ci --ignore-scripts | |
| - name: Build bundle | |
| run: node tools/build.js | |
| - name: Publish to npm | |
| # Auth comes from OIDC via Trusted Publishing — no NODE_AUTH_TOKEN. | |
| # --provenance attaches a signed attestation linking the tarball | |
| # to this exact workflow run (visible on the npm package page). | |
| run: npm publish --access public --provenance | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| generate_release_notes: true |