rolester 0.3.0 — company-health, docs site, analytics #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: publish | |
| # Publishes rolester to npm when a GitHub Release is published (or run manually). | |
| # | |
| # Auth: npm Trusted Publishing (OIDC) — NO token is stored. npm trusts this exact | |
| # workflow via the trusted-publisher connection configured on the package | |
| # (Settings → Trusted Publisher: GitHub Actions → CodesWhat/rolester → publish.yml, | |
| # permission "npm publish"). The job mints a short-lived credential from GitHub's | |
| # OIDC token at run time, so there is nothing to rotate or leak. If you ever rename | |
| # this file or move the repo, update the trusted-publisher connection to match. | |
| # | |
| # Each release: bump package.json "version" first. npm rejects republishing an | |
| # existing version, so the release tag must be a new version (0.1.0 is already live). | |
| # | |
| # Dist-tags: a prerelease version (any version containing "-", e.g. 0.2.0-rc.1) is | |
| # published to the "rc" dist-tag, so `npm i rolester` / `npm pack rolester@latest` | |
| # stay on the last stable release while testers opt in with `rolester@rc`. A plain | |
| # version (0.2.0) publishes to "latest" as usual. Mark the GitHub Release as a | |
| # pre-release when cutting an -rc build for clarity (the trigger fires either way). | |
| # | |
| # Provenance: Trusted Publishing generates a signed provenance attestation | |
| # automatically, so the npm package page shows "Built and signed on GitHub Actions" | |
| # linking back to this repo. | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| id-token: write # required for OIDC trusted publishing + provenance | |
| jobs: | |
| npm-publish: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| registry-url: https://registry.npmjs.org | |
| # Trusted Publishing (OIDC) requires npm >= 11.5.1; pin to latest to be safe. | |
| - name: Upgrade npm for trusted publishing | |
| run: npm install -g npm@latest | |
| - name: Publish to npm (unscoped, public, trusted publishing) | |
| run: | | |
| VERSION="$(node -p "require('./package.json').version")" | |
| if [[ "$VERSION" == *-* ]]; then TAG=rc; else TAG=latest; fi | |
| echo "Publishing v$VERSION to dist-tag: $TAG" | |
| npm publish --provenance --access public --tag "$TAG" |