gopherkind/.github/workflows/release.yml at main · forgesworn/gopherkind · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
name: release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: Release tag to publish
        type: string
        required: true

permissions:
  contents: write
  id-token: write

jobs:
  github-release:
    runs-on: ubuntu-latest
    env:
      RELEASE_TAG: ${{ inputs.tag || github.event.release.tag_name }}
      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.tag || github.event.release.tag_name }}
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.11.0
      - run: npm ci
      - run: npm run lint
      - run: npm run typecheck
      - run: npm run coverage
      - run: npm audit --audit-level=high
      - name: Verify tag and package version
        run: node -e "const p=require('./package.json'); if ('v'+p.version !== process.env.RELEASE_TAG) throw new Error('tag/version mismatch')"
      - name: Build release package and checksum
        run: |
          mkdir -p release
          npm pack --pack-destination release
          cd release
          sha256sum gopherkind-*.tgz > SHA256SUMS
      - name: Upload GitHub release assets
        run: |
          gh release view "$RELEASE_TAG" >/dev/null
          gh release upload "$RELEASE_TAG" release/gopherkind-*.tgz release/SHA256SUMS --clobber

  npm-release:
    needs: github-release
    if: vars.NPM_PUBLISH_ENABLED == 'true'
    uses: forgesworn/anvil/.github/workflows/release.yml@d4294e622932d93957d73e5b1af0267382b6af04 # v0
    with:
      tag: ${{ inputs.tag || '' }}