Skip to content

Commit 75b27e4

Browse files
davidkna-sapdavidkna-sap
committed
fix: Use trusted publishing for the canary workflow
1 parent e2c34f3 commit 75b27e4

File tree

3 files changed

+120
-83
lines changed

3 files changed

+120
-83
lines changed

‎.github/workflows/publish-canary.yml‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,15 @@
11
name: publish-canary
22

33
on:
4-
schedule:
5-
- cron: '0 1 * * *'
6-
workflow_dispatch:
4+
workflow_call:
75
inputs:
86
tag:
97
description: 'Dist tag for the release. If you chose something different than "canary", make sure to delete it once it is not needed anymore.'
108
type: string
119
required: false
1210
default: 'canary'
1311
jobs:
14-
publish:
12+
prepare-release:
1513
runs-on: ubuntu-latest
1614

1715
steps:
@@ -31,12 +29,22 @@ jobs:
3129
Canary release
3230
EOT
3331
34-
- name: publish
32+
- name: version canary release
3533
run: |
3634
date=`date +%Y%m%d%H%M%S`
3735
pnpm changeset pre enter ${date}
3836
pnpm changeset version
3937
pnpm changeset pre exit
40-
pnpm changeset publish --tag ${{ github.event_name == 'schedule' && 'canary' || inputs.tag }}
41-
env:
42-
NODE_AUTH_TOKEN: ${{ secrets.NPMJS_ACCESS_TOKEN }}
38+
39+
publish-npm:
40+
needs: prepare-release
41+
runs-on: ubuntu-latest
42+
permissions:
43+
id-token: write
44+
steps:
45+
- uses: sap/ai-sdk-js/.github/actions/setup@main
46+
with:
47+
node-version: 24 # Will install npm 11 needed for trusted publishing
48+
- name: publish
49+
run: |
50+
pnpm changeset publish

‎.github/workflows/publish-release.yml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: publish
2+
3+
on:
4+
workflow_call:
5+
6+
env:
7+
DOCS_REPO: SAP/ai-sdk
8+
9+
jobs:
10+
check-release-notes-pr:
11+
name: Check Release Notes PR Status
12+
runs-on: ubuntu-latest
13+
outputs:
14+
release_notes_branch: ${{ steps.determine-branch-name.outputs.release_notes_branch }}
15+
is_merged: ${{ steps.check_pr_status.outputs.merged }}
16+
steps:
17+
- uses: sap/ai-sdk-js/.github/actions/setup@main
18+
with:
19+
node-version: ${{ vars.DEFAULT_NODE_VERSION }}
20+
- name: Determine Docs PR Branch Name
21+
id: determine-branch-name
22+
run: |
23+
VERSION=$(pnpm node -p "require('./package.json').version")
24+
echo "Using version: $VERSION"
25+
BRANCH_NAME="update-release-notes-js-$VERSION"
26+
echo "release_notes_branch=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
27+
28+
- name: Check PR Status (Exists, Merged)
29+
id: check_pr_status
30+
run: |
31+
BRANCH_NAME="${{ steps.determine-branch-name.outputs.release_notes_branch }}"
32+
echo "Checking status for PR associated with branch: $BRANCH_NAME"
33+
34+
# Get merged status. If gh pr view fails (e.g., PR not found), the step will fail.
35+
MERGED_OUTPUT=$(gh pr view "$BRANCH_NAME" --repo "${{ env.DOCS_REPO }}" --json state --jq '.state == "MERGED" | tostring')
36+
37+
# This part only runs if the above command succeeded
38+
echo "PR found. Is Merged: $MERGED_OUTPUT"
39+
echo "merged=$MERGED_OUTPUT" >> "$GITHUB_OUTPUT"
40+
env:
41+
GH_TOKEN: ${{ secrets.GH_CLOUD_SDK_JS_ADMIN_WRITE_TOKEN }}
42+
43+
- name: 'Check Whether Release Notes PR Can Be Merged'
44+
if: steps.check_pr_status.outputs.merged == 'false'
45+
uses: ./.github/actions/pr-is-mergeable
46+
with:
47+
pr-ref: ${{ steps.determine-branch-name.outputs.release_notes_branch }}
48+
repo: ${{ env.DOCS_REPO }}
49+
token: ${{ secrets.GH_CLOUD_SDK_JS_ADMIN_WRITE_TOKEN }}
50+
excluded-check-runs: |
51+
{
52+
\"Build Cloud SDK Documentation\": [\"dependabot\"]
53+
}
54+
55+
publish-npm:
56+
name: Publish to NPM
57+
runs-on: ubuntu-latest
58+
needs: [check-release-notes-pr]
59+
permissions:
60+
id-token: write
61+
steps:
62+
- uses: sap/ai-sdk-js/.github/actions/setup@main
63+
with:
64+
node-version: 24 # Will install npm 11 needed for trusted publishing
65+
- name: publish
66+
run: |
67+
pnpm changeset publish
68+
69+
merge-release-notes-pr:
70+
name: Merge Release Notes PR (if needed)
71+
runs-on: ubuntu-latest
72+
needs: [check-release-notes-pr, publish-npm]
73+
if: needs.check-release-notes-pr.outputs.is_merged == 'false'
74+
steps:
75+
- name: 'Merge Release Notes PR'
76+
run: |
77+
echo "Attempting to merge PR for branch: ${{ needs.check-release-notes-pr.outputs.release_notes_branch }}"
78+
gh pr merge --squash "${{ needs.check-release-notes-pr.outputs.release_notes_branch }}" --delete-branch --repo "${{ env.DOCS_REPO }}"
79+
env:
80+
GH_TOKEN: ${{ secrets.GH_CLOUD_SDK_JS_ADMIN_WRITE_TOKEN }}

‎.github/workflows/publish.yml‎

Lines changed: 24 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -1,81 +1,30 @@
1-
name: publish
1+
# For trusted publishing releases, it is required to start all releases from a single workflow file.
2+
# This workflow delegates to the appropriate release workflow based on the event that triggered it.
23

34
on:
5+
# Triggers for canary releases
6+
schedule:
7+
- cron: '0 1 * * *'
8+
workflow_dispatch:
9+
inputs:
10+
tag:
11+
description: 'Dist tag for the release. If you chose something different than "canary", make sure to delete it once it is not needed anymore.'
12+
type: string
13+
required: false
14+
default: 'canary'
15+
# Triggers for official releases
416
release:
517
types: [published] # Trigger when a GitHub Release is published
618

7-
env:
8-
DOCS_REPO: SAP/ai-sdk
9-
1019
jobs:
11-
check-release-notes-pr:
12-
name: Check Release Notes PR Status
13-
runs-on: ubuntu-latest
14-
outputs:
15-
release_notes_branch: ${{ steps.determine-branch-name.outputs.release_notes_branch }}
16-
is_merged: ${{ steps.check_pr_status.outputs.merged }}
17-
steps:
18-
- uses: sap/ai-sdk-js/.github/actions/setup@main
19-
with:
20-
node-version: ${{ vars.DEFAULT_NODE_VERSION }}
21-
- name: Determine Docs PR Branch Name
22-
id: determine-branch-name
23-
run: |
24-
VERSION=$(pnpm node -p "require('./package.json').version")
25-
echo "Using version: $VERSION"
26-
BRANCH_NAME="update-release-notes-js-$VERSION"
27-
echo "release_notes_branch=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
28-
29-
- name: Check PR Status (Exists, Merged)
30-
id: check_pr_status
31-
run: |
32-
BRANCH_NAME="${{ steps.determine-branch-name.outputs.release_notes_branch }}"
33-
echo "Checking status for PR associated with branch: $BRANCH_NAME"
34-
35-
# Get merged status. If gh pr view fails (e.g., PR not found), the step will fail.
36-
MERGED_OUTPUT=$(gh pr view "$BRANCH_NAME" --repo "${{ env.DOCS_REPO }}" --json state --jq '.state == "MERGED" | tostring')
37-
38-
# This part only runs if the above command succeeded
39-
echo "PR found. Is Merged: $MERGED_OUTPUT"
40-
echo "merged=$MERGED_OUTPUT" >> "$GITHUB_OUTPUT"
41-
env:
42-
GH_TOKEN: ${{ secrets.GH_CLOUD_SDK_JS_ADMIN_WRITE_TOKEN }}
43-
44-
- name: 'Check Whether Release Notes PR Can Be Merged'
45-
if: steps.check_pr_status.outputs.merged == 'false'
46-
uses: ./.github/actions/pr-is-mergeable
47-
with:
48-
pr-ref: ${{ steps.determine-branch-name.outputs.release_notes_branch }}
49-
repo: ${{ env.DOCS_REPO }}
50-
token: ${{ secrets.GH_CLOUD_SDK_JS_ADMIN_WRITE_TOKEN }}
51-
excluded-check-runs: |
52-
{
53-
\"Build Cloud SDK Documentation\": [\"dependabot\"]
54-
}
55-
56-
publish-npm:
57-
name: Publish to NPM
58-
runs-on: ubuntu-latest
59-
needs: [check-release-notes-pr]
60-
permissions:
61-
id-token: write
62-
steps:
63-
- uses: sap/ai-sdk-js/.github/actions/setup@main
64-
with:
65-
node-version: 24 # Will install npm 11 needed for trusted publishing
66-
- name: publish
67-
run: |
68-
pnpm changeset publish
69-
70-
merge-release-notes-pr:
71-
name: Merge Release Notes PR (if needed)
72-
runs-on: ubuntu-latest
73-
needs: [check-release-notes-pr, publish-npm]
74-
if: needs.check-release-notes-pr.outputs.is_merged == 'false'
75-
steps:
76-
- name: 'Merge Release Notes PR'
77-
run: |
78-
echo "Attempting to merge PR for branch: ${{ needs.check-release-notes-pr.outputs.release_notes_branch }}"
79-
gh pr merge --squash "${{ needs.check-release-notes-pr.outputs.release_notes_branch }}" --delete-branch --repo "${{ env.DOCS_REPO }}"
80-
env:
81-
GH_TOKEN: ${{ secrets.GH_CLOUD_SDK_JS_ADMIN_WRITE_TOKEN }}
20+
delegate_to_release_job:
21+
if: ${{ github.event_name == 'release' }}
22+
uses: ./.github/workflows/publish-release.yml
23+
secrets: inherit
24+
25+
delegate_to_canary_job:
26+
if: ${{ github.event_name != 'release' }}
27+
uses: ./.github/workflows/publish-canary.yml
28+
secrets: inherit
29+
with:
30+
tag: ${{ github.event_name == 'schedule' && github.event.inputs.tag || 'canary' }}

0 commit comments

Comments
 (0)