chore: close out ds 13 #102
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Publishes to npm when conventional commits on main warrant a release. | |
| # | |
| # GitHub API / git push: uses a GitHub App installation token (not the default GITHUB_TOKEN). | |
| # Organization (or repo) configuration — create these names or map your existing ones: | |
| # Variable: GRAPHREFLY_WRITE_CONTENT_APP_ID → numeric App ID | |
| # Secret: GRAPHREFLY_WRITE_CONTENT_APP_PRIVATE_KEY → PEM private key (full key, including BEGIN/END lines) | |
| # | |
| # Install the app on the org (or this repo) with permissions semantic-release needs: | |
| # Contents: Read and write (push release commit, tags) | |
| # Issues: Write (release comments on issues) | |
| # Pull requests: Write (release comments on PRs) | |
| # Metadata: Read (default) | |
| # | |
| # npm Trusted Publishing: package settings on npmjs.com must list this repo + this workflow file. | |
| # Requires @semantic-release/npm ^13 and id-token: write. Optional secret NPM_TOKEN if not using OIDC. | |
| # https://docs.npmjs.com/trusted-publishers | |
| # | |
| # Repo Settings → Actions → General: allow workflows to create pull requests if your org policy blocks it. | |
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: release-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| name: Release | |
| if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }} | |
| runs-on: ubuntu-latest | |
| env: | |
| NODE_ENV: production | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Create GitHub App installation token | |
| id: app-token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| app-id: ${{ vars.GRAPHREFLY_WRITE_CONTENT_APP_ID }} | |
| private-key: ${{ secrets.GRAPHREFLY_WRITE_CONTENT_APP_PRIVATE_KEY }} | |
| permission-contents: write | |
| permission-issues: write | |
| permission-pull-requests: write | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ steps.app-token.outputs.token }} | |
| persist-credentials: true | |
| - name: Configure Git committer (GitHub App) | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| user_id=$(gh api "users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id) | |
| git config user.name '${{ steps.app-token.outputs.app-slug }}[bot]' | |
| git config user.email "${user_id}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com" | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: lts/* | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Test | |
| run: NODE_ENV=test pnpm test | |
| - name: Lint | |
| run: pnpm run lint | |
| # Build once here; do not use prepublishOnly — npm publish would run a second full tsup+DTS | |
| # build in a subprocess (OOM / flaky on runners). semantic-release prepare only bumps version. | |
| - name: Build package | |
| env: | |
| NODE_OPTIONS: --max-old-space-size=6144 | |
| run: pnpm run build | |
| - name: Release | |
| env: | |
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: pnpm exec semantic-release |