Skip to content

Commit 79fa9b2

Browse files
ethan-ozelius-contentfulethan-ozelius-contentful
committed
feat(trusted-publishing): initial commit to add github actions to support OIDC trusted publishing.
Added github actions: main, check, build and release Added a new channel testing-oidc-trusted-publishing for testing npmjs package deployments
1 parent 97c9125 commit 79fa9b2

File tree

7 files changed

+169
-3
lines changed

7 files changed

+169
-3
lines changed

‎.github/workflows/build.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Build
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
build:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- name: Checkout code
12+
uses: actions/checkout@v5
13+
14+
- name: Setup Node.js
15+
uses: actions/setup-node@v6
16+
with:
17+
node-version: '24'
18+
cache: 'npm'
19+
20+
- name: Install dependencies
21+
run: npm ci
22+
23+
- name: Build
24+
run: npm run build
25+
26+
- name: Save Build folders
27+
uses: actions/cache/save@v4
28+
with:
29+
path: |
30+
dist
31+
key: build-cache-${{ github.run_id }}-${{ github.run_attempt }}

‎.github/workflows/check.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
2+
name: Run Checks
3+
4+
on:
5+
workflow_call:
6+
7+
jobs:
8+
lint:
9+
runs-on: ubuntu-latest
10+
11+
steps:
12+
- name: Checkout code
13+
uses: actions/checkout@v5
14+
15+
- name: Setup Node.js
16+
uses: actions/setup-node@v6
17+
with:
18+
node-version: '24'
19+
cache: 'npm'
20+
21+
- name: Install dependencies
22+
run: npm ci
23+
24+
- name: Restore the build folders
25+
uses: actions/cache/restore@v4
26+
with:
27+
path: |
28+
dist
29+
key: build-cache-${{ github.run_id }}-${{ github.run_attempt }}
30+
31+
- name: Run linter
32+
run: npm run lint
33+
34+
- name: Check prettier formatting
35+
run: npm run prettier:check
36+
37+
- name: Check formatting
38+
run: npm run format:check
39+
40+
- name: Run tests
41+
run: npm test
42+
43+
- name: Test bundle size
44+
run: npm run test:size
45+
46+
- name: Test TypeScript types
47+
run: npm run test:types

‎.github/workflows/codeql.yml‎ renamed to ‎.github/workflows/codeql.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,14 @@ jobs:
1919
security-events: write
2020

2121
steps:
22-
- uses: actions/checkout@v4
22+
- uses: actions/checkout@v5
2323

2424
- name: Initialize CodeQL
25-
uses: github/codeql-action/init@v3
25+
uses: github/codeql-action/init@v4
2626
with:
2727
languages: actions
2828

2929
- name: Run CodeQL Analysis
30-
uses: github/codeql-action/analyze@v3
30+
uses: github/codeql-action/analyze@v4
3131
with:
3232
category: actions

‎.github/workflows/dependabot-approve-and-request-merge.yml‎ renamed to ‎.github/workflows/dependabot-approve-and-request-merge.yaml‎

File renamed without changes.

‎.github/workflows/main.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: CI
2+
permissions:
3+
contents: read
4+
5+
on:
6+
push:
7+
branches: ['master', 'next', 'testing-oidc-trusted-publishing']
8+
pull_request:
9+
branches: ['*']
10+
11+
jobs:
12+
build:
13+
uses: ./.github/workflows/build.yml
14+
15+
check:
16+
needs: build
17+
uses: ./.github/workflows/check.yml
18+
19+
release:
20+
# TODO: remove 'testing-oidc-trusted-publishing' branch once trusted publishing is stable
21+
if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/testing-oidc-trusted-publishing' || github.ref == 'refs/heads/next')
22+
needs: [build, check]
23+
permissions:
24+
contents: write
25+
id-token: write
26+
actions: read
27+
uses: ./.github/workflows/release.yml
28+
secrets:
29+
VAULT_URL: ${{ secrets.VAULT_URL }}

‎.github/workflows/release.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: release
2+
3+
permissions:
4+
contents: read
5+
# packages: read
6+
7+
on:
8+
push:
9+
branches:
10+
- master
11+
- next
12+
- testing-oidc-trusted-publishing
13+
pull_request:
14+
branches:
15+
- master
16+
17+
jobs:
18+
release:
19+
name: Release
20+
permissions:
21+
# packages: write
22+
id-token: write # Required for OIDC trusted publishing
23+
runs-on: ubuntu-latest
24+
steps:
25+
- name: Checkout code
26+
uses: actions/checkout@v5
27+
28+
- name: Setup Node.js
29+
uses: actions/setup-node@v6
30+
with:
31+
node-version: '24'
32+
# registry-url: 'https://registry.npmjs.org'
33+
cache: 'npm'
34+
35+
- name: Install dependencies
36+
run: npm ci
37+
38+
- name: Restore the build folders
39+
uses: actions/cache/restore@v4
40+
with:
41+
path: |
42+
dist
43+
key: build-cache-${{ github.run_id }}-${{ github.run_attempt }}
44+
45+
- name: Setup Chrome
46+
uses: browser-actions/setup-chrome@v2
47+
with:
48+
install-chromedriver: true
49+
50+
- name: Run semantic release
51+
run: npm run semantic-release
52+
# env:
53+
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
54+
# NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

‎package.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,11 @@
159159
"name": "next",
160160
"channel": "next",
161161
"prerelease": true
162+
},
163+
{
164+
"name": "testing-oidc-trusted-publishing",
165+
"channel": "testing-oidc-trusted-publishing",
166+
"prerelease": true
162167
}
163168
],
164169
"plugins": [

0 commit comments

Comments
 (0)