armory-memory/.github/workflows/release.yml at main · getpipher/armory-memory · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
name: Release

# Publishes @getpipher/armory-memory to npm on tag push (v*).
# Uses the getpipher org secret NPM_TOKEN (granular npm token, Read-and-write,
# scoped to @getpipher, with "Bypass 2FA" — no OTP needed). Inherited by all
# getpipher repos.  gh secret set NPM_TOKEN --org getpipher
#
# Idempotent: skips if the version is already on npm (safe to re-run).
# Gates on tests before publishing. No build step (extensions ship raw .ts,
# run via tsx at pi runtime) — no typecheck (no tsconfig by design).

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write  # needed to create GitHub Releases on tag push

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "24"
          registry-url: https://registry.npmjs.org

      # No lockfile + only optional peer deps → a bare install is enough.
      # The test suite runs via node directly (native TS in node 24).
      # SPEC-1b-3 D5: contract tests import the REAL @getpipher/armory-gateway
      # (private repo — token-less clone fails). SIBLINGS_PAT is a per-repo secret.
      - name: Clone armory-gateway (private sibling — contract tests require it)
        env:
          SIBLINGS_PAT: ${{ secrets.SIBLINGS_PAT }}
        run: git clone --depth 1 https://x-access-token:${SIBLINGS_PAT}@github.com/getpipher/armory-gateway.git ../armory-gateway

      # Bare clone has no node_modules — the contract-test import pulls gateway's
      # full src tree (client.ts → @modelcontextprotocol/sdk …), so its own deps
      # must be installed before `npm test`.
      - name: Install gateway deps (bare clone has none)
        working-directory: ../armory-gateway
        run: npm install --ignore-scripts

      - run: npm install --ignore-scripts

      - name: Run tests
        run: npm test
        env:
          ARMORY_GATEWAY_PATH: ${{ github.workspace }}/../armory-gateway

      - name: Skip if already published
        id: check
        run: |
          set -u
          ver=$(node -p "require('./package.json').version")
          pkg=$(node -p "require('./package.json').name")
          existing=$(npm view "$pkg@$ver" version 2>/dev/null || true)
          if [ "$existing" = "$ver" ]; then
            echo "::notice::$pkg@$ver already on npm — skipping publish"
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "Publishing $pkg@$ver"
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish
        if: steps.check.outputs.skip != 'true'
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --access public

      - name: Create GitHub Release
        if: success()
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="${GITHUB_REF_NAME}"
          if gh release view "$tag" >/dev/null 2>&1; then
            echo "::notice::Release $tag already exists — skipping"
          else
            gh release create "$tag" --generate-notes --title "$tag"
          fi