npm-publish.yml

name: npm publish 

# Packages are intentionally not published by this workflow yet. Once the
# generated package contents have been verified, remove --dry-run from the
# publish command and update the workflow name.
on:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: npm-publish
  cancel-in-progress: false

jobs:
  publish-dry-run:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org
          # cache: npm

      # Internal packages may not exist in the npm registry yet. Normalize
      # their dependency specs temporarily so npm links every dependency from
      # the checked-out workspaces instead of trying to download it.
      - name: Link local workspace packages
        run: node scripts/link-local-workspaces.mjs

      - name: Install dependencies
        run: npm install --no-audit --no-fund

      - name: Build publishable packages
        run: npm run build:packages

      # link-local-workspaces.mjs changes internal dependency specs to "*".
      # Restore the committed manifests after the build so those temporary
      # specs are never included in a published package.
      - name: Restore package manifests for publishing
        run: git submodule foreach --recursive 'git restore --source=HEAD -- package.json'

      - name: Preview npm packages
        shell: bash
        run: |
          set -euo pipefail

          mapfile -t packages < <(
            npm query .workspace --json | node -e '
              let input = "";
              process.stdin.on("data", chunk => input += chunk);
              process.stdin.on("end", () => {
                for (const workspace of JSON.parse(input)) {
                  if (!workspace.private) console.log(workspace.name);
                }
              });
            '
          )

          for package in "${packages[@]}"; do
            echo "::group::${package}"

            # Skip previewing when the local version is already on the registry.
            local_version="$(npm pkg get version --workspace "${package}" | node -e '
              let input = "";
              process.stdin.on("data", chunk => input += chunk);
              process.stdin.on("end", () => {
                const parsed = JSON.parse(input);
                const version = typeof parsed === "string" ? parsed : Object.values(parsed)[0];
                process.stdout.write(version);
              });
            ')"

            if npm view "${package}@${local_version}" version >/dev/null 2>&1; then
              echo "Skipping ${package}@${local_version}: already published."
              echo "::endgroup::"
              continue
            fi

            npm publish --workspace "${package}" --access public --dry-run
            echo "::endgroup::"
          done
        env:
          # npm checks authentication even for a publish dry run.
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish npm packages
        shell: bash
        run: |
          set -euo pipefail

          mapfile -t packages < <(
            npm query .workspace --json | node -e '
              let input = "";
              process.stdin.on("data", chunk => input += chunk);
              process.stdin.on("end", () => {
                for (const workspace of JSON.parse(input)) {
                  if (!workspace.private) console.log(workspace.name);
                }
              });
            '
          )

          for package in "${packages[@]}"; do
            echo "::group::${package}"

            # Skip publishing when the local version is already on the registry.
            local_version="$(npm pkg get version --workspace "${package}" | node -e '
              let input = "";
              process.stdin.on("data", chunk => input += chunk);
              process.stdin.on("end", () => {
                const parsed = JSON.parse(input);
                const version = typeof parsed === "string" ? parsed : Object.values(parsed)[0];
                process.stdout.write(version);
              });
            ')"

            if npm view "${package}@${local_version}" version >/dev/null 2>&1; then
              echo "Skipping ${package}@${local_version}: already published."
              echo "::endgroup::"
              continue
            fi

            npm publish --workspace "${package}" --access public
            echo "::endgroup::"
          done
        env:
          # npm checks authentication even for a publish.
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}