ci: bump supabase/sdk reusable workflows to capability-matrix-v1.6.0 … #729
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish releases | |
| # Consolidates canary and stable releases into single workflow | |
| # Trusted workflow for publishing to npm | |
| on: | |
| push: | |
| branches: [master] | |
| paths-ignore: | |
| - '*.md' | |
| - 'docs/**' | |
| - '**/CHANGELOG.md' | |
| workflow_dispatch: | |
| inputs: | |
| version_specifier: | |
| description: 'Stable: semver bump (patch|minor|major|pre*) or exact version (v1.2.3)' | |
| required: false | |
| type: string | |
| beta_version: | |
| description: 'Beta: explicit prerelease version (e.g. 2.101.0-beta.0). Select your feature branch above.' | |
| required: false | |
| type: string | |
| next_prerelease: | |
| description: 'Next: publish a v3 prerelease from the selected branch (must be v3).' | |
| required: false | |
| type: boolean | |
| default: false | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} | |
| cancel-in-progress: ${{ github.event_name == 'push' }} | |
| jobs: | |
| release-stable: # stable releases can only be manually triggered | |
| if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.version_specifier != '' }} | |
| runs-on: ubuntu-latest | |
| environment: npm-publish | |
| outputs: | |
| released_version: ${{ steps.extract-version.outputs.version }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Generate token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.APP_CLIENT_ID }} | |
| private-key: ${{ secrets.PRIVATE_KEY }} | |
| - name: Check if actor is member of admin or sdk team | |
| id: team-check | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| github-token: ${{ steps.app-token.outputs.token }} | |
| script: | | |
| const org = 'supabase' | |
| const actor = process.env.GITHUB_TRIGGERING_ACTOR | |
| async function isTeamMember(team_slug) { | |
| try { | |
| const res = await github.rest.teams.getMembershipForUserInOrg({ | |
| org, | |
| team_slug, | |
| username: actor, | |
| }) | |
| return res && res.status === 200 | |
| } catch (_) { | |
| return false | |
| } | |
| } | |
| const isAdmin = await isTeamMember('admin') | |
| const isSdk = await isTeamMember('sdk') | |
| const isMember = isAdmin || isSdk | |
| core.setOutput('is_team_member', isMember ? 'true' : 'false') | |
| - name: Fail if not authorized | |
| if: ${{ steps.team-check.outputs.is_team_member != 'true' }} | |
| run: | | |
| echo "You must be a member of @supabase/admin or @supabase/sdk." | |
| exit 1 | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| - name: Configure Dependency Firewall registry | |
| shell: bash | |
| env: | |
| DF_FIREWALL_TOKEN: ${{ secrets.DF_FIREWALL_TOKEN }} | |
| run: | | |
| # The firewall token is withheld from fork-triggered PR runs, so only route | |
| # through the firewall when the token is present. Forks fall back to the | |
| # default public npm registry (install still uses --frozen-lockfile). | |
| if [ -n "$DF_FIREWALL_TOKEN" ]; then | |
| pnpm config set //firewall.depthfirst.com/npm/:_authToken "$DF_FIREWALL_TOKEN" | |
| pnpm config set registry https://firewall.depthfirst.com/npm/ | |
| else | |
| echo "No DF_FIREWALL_TOKEN (likely a fork PR); using the default public npm registry." | |
| fi | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version-file: '.nvmrc' | |
| cache: 'pnpm' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Setup Deno | |
| uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5 | |
| with: | |
| deno-version: v2.8.2 | |
| - name: Export pinned Deno path | |
| run: echo "DENO_BIN_PATH=$(which deno)" >> "$GITHUB_ENV" | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Configure git | |
| run: | | |
| git config --global user.name "supabase-releaser[bot]" | |
| git config --global user.email "supabase-releaser[bot]@users.noreply.github.com" | |
| - name: Validate input | |
| env: | |
| VERSION_SPECIFIER: ${{ github.event.inputs.version_specifier }} | |
| run: | | |
| VS="${VERSION_SPECIFIER}" | |
| echo "Validating: $VS" | |
| if [[ "$VS" =~ ^(patch|minor|major|prepatch|preminor|premajor|prerelease)$ ]]; then | |
| echo "✔ bump keyword" | |
| elif [[ "$VS" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then | |
| echo "✔ explicit version" | |
| else | |
| echo "❌ Invalid version_specifier: '$VS'" | |
| echo " Use: patch|minor|major|pre*, or v1.2.3" | |
| exit 1 | |
| fi | |
| - name: Release stable version | |
| env: | |
| NPM_CONFIG_PROVENANCE: true | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| RELEASE_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| VERSION_SPECIFIER: ${{ github.event.inputs.version_specifier }} | |
| shell: bash | |
| run: pnpm run release-stable -- --versionSpecifier "$VERSION_SPECIFIER" | |
| - name: Extract released version | |
| id: extract-version | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| VERSION=$(cat .release-version) | |
| if [[ -z "$VERSION" ]]; then | |
| exit 1 | |
| fi | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Summary | |
| if: ${{ success() }} | |
| env: | |
| VERSION_SPECIFIER: ${{ github.event.inputs.version_specifier }} | |
| run: | | |
| echo "## ✅ Stable Release" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Version specifier:** \`${VERSION_SPECIFIER}\`" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Source commit:** HEAD of the checked-out branch" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Dist-tag:** \`latest\`" >> $GITHUB_STEP_SUMMARY | |
| docs-after-stable-release: | |
| name: Generate Documentation | |
| needs: release-stable | |
| if: ${{ github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'success' }} | |
| uses: ./.github/workflows/docs.yml | |
| permissions: | |
| actions: read | |
| contents: write | |
| secrets: inherit | |
| trigger-dogfood: | |
| name: Trigger Dogfood | |
| needs: release-stable | |
| if: ${{ github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'success' }} | |
| uses: ./.github/workflows/dogfood.yml | |
| secrets: | |
| APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }} | |
| PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }} | |
| DOGFOOD_APP_CLIENT_ID: ${{ secrets.DOGFOOD_APP_CLIENT_ID }} | |
| DOGFOOD_APP_PRIVATE_KEY: ${{ secrets.DOGFOOD_APP_PRIVATE_KEY }} | |
| with: | |
| version: ${{ needs.release-stable.outputs.released_version }} | |
| source: supabase-js-stable-release | |
| trigger-supabase-docs-update: | |
| name: Trigger Supabase Docs Update | |
| runs-on: ubuntu-latest | |
| needs: [release-stable, docs-after-stable-release] | |
| if: ${{ github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'success' && needs.docs-after-stable-release.result == 'success' }} | |
| steps: | |
| - name: Generate token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.APP_CLIENT_ID }} | |
| private-key: ${{ secrets.PRIVATE_KEY }} | |
| owner: supabase | |
| repositories: supabase, supabase-js | |
| - name: Trigger supabase/supabase docs workflow | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| github-token: ${{ steps.app-token.outputs.token }} | |
| script: | | |
| await github.rest.actions.createWorkflowDispatch({ | |
| owner: 'supabase', | |
| repo: 'supabase', | |
| workflow_id: 'docs-js-libs-update.yml', | |
| ref: 'master', | |
| inputs: { | |
| version: '${{ needs.release-stable.outputs.released_version }}', | |
| source: 'supabase-js-stable-release' | |
| } | |
| }); | |
| release-beta: | |
| if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.beta_version != '' }} | |
| runs-on: ubuntu-latest | |
| environment: npm-publish | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Generate token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.APP_CLIENT_ID }} | |
| private-key: ${{ secrets.PRIVATE_KEY }} | |
| - name: Check if actor is member of admin or sdk team | |
| id: team-check | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| github-token: ${{ steps.app-token.outputs.token }} | |
| script: | | |
| const org = 'supabase' | |
| const actor = process.env.GITHUB_TRIGGERING_ACTOR | |
| async function isTeamMember(team_slug) { | |
| try { | |
| const res = await github.rest.teams.getMembershipForUserInOrg({ | |
| org, | |
| team_slug, | |
| username: actor, | |
| }) | |
| return res && res.status === 200 | |
| } catch (_) { | |
| return false | |
| } | |
| } | |
| const isAdmin = await isTeamMember('admin') | |
| const isSdk = await isTeamMember('sdk') | |
| const isMember = isAdmin || isSdk | |
| core.setOutput('is_team_member', isMember ? 'true' : 'false') | |
| - name: Fail if not authorized | |
| if: ${{ steps.team-check.outputs.is_team_member != 'true' }} | |
| run: | | |
| echo "You must be a member of @supabase/admin or @supabase/sdk." | |
| exit 1 | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| - name: Configure Dependency Firewall registry | |
| shell: bash | |
| env: | |
| DF_FIREWALL_TOKEN: ${{ secrets.DF_FIREWALL_TOKEN }} | |
| run: | | |
| # The firewall token is withheld from fork-triggered PR runs, so only route | |
| # through the firewall when the token is present. Forks fall back to the | |
| # default public npm registry (install still uses --frozen-lockfile). | |
| if [ -n "$DF_FIREWALL_TOKEN" ]; then | |
| pnpm config set //firewall.depthfirst.com/npm/:_authToken "$DF_FIREWALL_TOKEN" | |
| pnpm config set registry https://firewall.depthfirst.com/npm/ | |
| else | |
| echo "No DF_FIREWALL_TOKEN (likely a fork PR); using the default public npm registry." | |
| fi | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version-file: '.nvmrc' | |
| cache: 'pnpm' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Setup Deno | |
| uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5 | |
| with: | |
| deno-version: v2.8.2 | |
| - name: Export pinned Deno path | |
| run: echo "DENO_BIN_PATH=$(which deno)" >> "$GITHUB_ENV" | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Configure git | |
| run: | | |
| git config --global user.name "supabase-releaser[bot]" | |
| git config --global user.email "supabase-releaser[bot]@users.noreply.github.com" | |
| - name: Release Beta version | |
| env: | |
| NPM_CONFIG_PROVENANCE: true | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| RELEASE_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| BETA_VERSION: ${{ github.event.inputs.beta_version }} | |
| run: pnpm run release-beta -- --version "$BETA_VERSION" | |
| - name: Summary | |
| if: ${{ success() }} | |
| env: | |
| BETA_VERSION: ${{ github.event.inputs.beta_version }} | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| echo "## ✅ Beta Release" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Version:** \`${BETA_VERSION}\`" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Branch:** \`${REF_NAME}\`" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Dist-tag:** \`beta\`" >> $GITHUB_STEP_SUMMARY | |
| notify-beta-failure: | |
| name: Notify Slack for Beta failure | |
| needs: release-beta | |
| if: ${{ always() && github.event_name == 'workflow_dispatch' && needs.release-beta.result == 'failure' }} | |
| uses: ./.github/workflows/slack-notify.yml | |
| secrets: | |
| SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }} | |
| with: | |
| title: 'Beta Release' | |
| status: 'failure' | |
| notify-beta-success: | |
| name: Notify Slack for Beta success | |
| needs: release-beta | |
| if: ${{ github.event_name == 'workflow_dispatch' && needs.release-beta.result == 'success' }} | |
| uses: ./.github/workflows/slack-notify.yml | |
| secrets: | |
| SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }} | |
| with: | |
| title: 'Beta Release' | |
| status: 'success' | |
| version: ${{ github.event.inputs.beta_version }} | |
| release-next: | |
| # v3 next prerelease — manual dispatch only, must be run from the v3 branch. | |
| if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.next_prerelease == 'true' && github.ref == 'refs/heads/v3' }} | |
| runs-on: ubuntu-latest | |
| environment: npm-publish | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Generate token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.APP_CLIENT_ID }} | |
| private-key: ${{ secrets.PRIVATE_KEY }} | |
| - name: Check if actor is member of admin or sdk team | |
| id: team-check | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| github-token: ${{ steps.app-token.outputs.token }} | |
| script: | | |
| const org = 'supabase' | |
| const actor = process.env.GITHUB_TRIGGERING_ACTOR | |
| async function isTeamMember(team_slug) { | |
| try { | |
| const res = await github.rest.teams.getMembershipForUserInOrg({ | |
| org, | |
| team_slug, | |
| username: actor, | |
| }) | |
| return res && res.status === 200 | |
| } catch (_) { | |
| return false | |
| } | |
| } | |
| const isAdmin = await isTeamMember('admin') | |
| const isSdk = await isTeamMember('sdk') | |
| const isMember = isAdmin || isSdk | |
| core.setOutput('is_team_member', isMember ? 'true' : 'false') | |
| - name: Fail if not authorized | |
| if: ${{ steps.team-check.outputs.is_team_member != 'true' }} | |
| run: | | |
| echo "You must be a member of @supabase/admin or @supabase/sdk." | |
| exit 1 | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| - name: Configure Dependency Firewall registry | |
| shell: bash | |
| env: | |
| DF_FIREWALL_TOKEN: ${{ secrets.DF_FIREWALL_TOKEN }} | |
| run: | | |
| # The firewall token is withheld from fork-triggered PR runs, so only route | |
| # through the firewall when the token is present. Forks fall back to the | |
| # default public npm registry (install still uses --frozen-lockfile). | |
| if [ -n "$DF_FIREWALL_TOKEN" ]; then | |
| pnpm config set //firewall.depthfirst.com/npm/:_authToken "$DF_FIREWALL_TOKEN" | |
| pnpm config set registry https://firewall.depthfirst.com/npm/ | |
| else | |
| echo "No DF_FIREWALL_TOKEN (likely a fork PR); using the default public npm registry." | |
| fi | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version-file: '.nvmrc' | |
| cache: 'pnpm' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Setup Deno | |
| uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5 | |
| with: | |
| deno-version: v2.8.2 | |
| - name: Export pinned Deno path | |
| run: echo "DENO_BIN_PATH=$(which deno)" >> "$GITHUB_ENV" | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Configure git | |
| run: | | |
| git config --global user.name "supabase-releaser[bot]" | |
| git config --global user.email "supabase-releaser[bot]@users.noreply.github.com" | |
| - name: Release v3 next prerelease | |
| env: | |
| NPM_CONFIG_PROVENANCE: true | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| RELEASE_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| BASE_VERSION=$(cat .next-base-version | tr -d '[:space:]') | |
| echo "Publishing v3 next prerelease (base: ${BASE_VERSION})..." | |
| pnpm run release-canary -- --base-version "$BASE_VERSION" --preid next --tag next | |
| - name: Summary | |
| if: ${{ success() }} | |
| run: | | |
| echo "## ✅ Next Prerelease" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Branch:** \`${GITHUB_REF_NAME}\`" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Dist-tag:** \`next\`" >> $GITHUB_STEP_SUMMARY | |
| # preview jobs | |
| ci-core: | |
| if: ${{ github.event_name == 'push' }} | |
| name: Core Packages CI | |
| uses: ./.github/workflows/ci-core.yml | |
| permissions: | |
| actions: read | |
| contents: read | |
| secrets: inherit | |
| ci-supabase-js: | |
| if: ${{ github.event_name == 'push' }} | |
| name: Supabase-JS Integration CI | |
| uses: ./.github/workflows/ci-supabase-js.yml | |
| permissions: | |
| actions: read | |
| contents: read | |
| secrets: inherit | |
| # ========================================== | |
| # COVERALLS FINISH (aggregates coverage from all packages) | |
| # ========================================== | |
| coveralls-finish: | |
| name: Coveralls Finished | |
| runs-on: ubuntu-latest | |
| needs: [ci-core, ci-supabase-js] | |
| if: github.event_name == 'push' | |
| steps: | |
| - name: Coveralls Finished | |
| uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| parallel-finished: true | |
| carryforward: 'auth-js,functions-js,postgrest-js,realtime-js,storage-js,supabase-js' | |
| fail-on-error: false | |
| continue-on-error: true | |
| # ========================================== | |
| # CANARY RELEASE (only on master, after all CI passes) | |
| # ========================================== | |
| release-canary: | |
| name: Release Prerelease | |
| runs-on: ubuntu-latest | |
| environment: npm-publish | |
| needs: [ci-core, ci-supabase-js] | |
| permissions: | |
| contents: read | |
| id-token: write | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| outputs: | |
| partial_failure: ${{ steps.release.outputs.partial_failure }} | |
| partial_failure_reason: ${{ steps.release.outputs.partial_failure_reason }} | |
| # Run on master branch pushes, only if all CI jobs succeeded | |
| if: | | |
| github.event_name == 'push' && | |
| github.ref == 'refs/heads/master' && | |
| needs.ci-core.result == 'success' && | |
| needs.ci-supabase-js.result == 'success' | |
| steps: | |
| - name: Generate token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.APP_CLIENT_ID }} | |
| private-key: ${{ secrets.PRIVATE_KEY }} | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| - name: Configure Dependency Firewall registry | |
| shell: bash | |
| env: | |
| DF_FIREWALL_TOKEN: ${{ secrets.DF_FIREWALL_TOKEN }} | |
| run: | | |
| # The firewall token is withheld from fork-triggered PR runs, so only route | |
| # through the firewall when the token is present. Forks fall back to the | |
| # default public npm registry (install still uses --frozen-lockfile). | |
| if [ -n "$DF_FIREWALL_TOKEN" ]; then | |
| pnpm config set //firewall.depthfirst.com/npm/:_authToken "$DF_FIREWALL_TOKEN" | |
| pnpm config set registry https://firewall.depthfirst.com/npm/ | |
| else | |
| echo "No DF_FIREWALL_TOKEN (likely a fork PR); using the default public npm registry." | |
| fi | |
| - name: Setup Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version-file: '.nvmrc' | |
| cache: 'pnpm' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Setup Deno | |
| uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5 | |
| with: | |
| deno-version: v2.8.2 | |
| - name: Export pinned Deno path | |
| run: echo "DENO_BIN_PATH=$(which deno)" >> "$GITHUB_ENV" | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Configure git | |
| run: | | |
| git config --global user.name "supabase-releaser[bot]" | |
| git config --global user.email "supabase-releaser[bot]@users.noreply.github.com" | |
| - name: Release canary version | |
| id: release | |
| run: pnpm run release-canary | |
| env: | |
| NPM_CONFIG_PROVENANCE: true | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| RELEASE_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | |
| notify-stable-failure: | |
| name: Notify Slack for Stable failure | |
| needs: release-stable | |
| if: ${{ always() && github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'failure' }} | |
| uses: ./.github/workflows/slack-notify.yml | |
| secrets: | |
| SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }} | |
| with: | |
| title: 'Stable Release' | |
| status: 'failure' | |
| notify-stable-success: | |
| name: Notify Slack for Stable success | |
| needs: release-stable | |
| if: ${{ github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'success' }} | |
| uses: ./.github/workflows/slack-notify.yml | |
| secrets: | |
| SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }} | |
| with: | |
| title: 'Stable Release' | |
| status: 'success' | |
| version: ${{ needs.release-stable.outputs.released_version }} | |
| notify-canary-failure: | |
| name: Notify Slack for Canary failure | |
| needs: release-canary | |
| if: ${{ always() && github.event_name == 'push' && needs.release-canary.result == 'failure' }} | |
| uses: ./.github/workflows/slack-notify.yml | |
| secrets: | |
| SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }} | |
| with: | |
| title: 'Canary Release' | |
| status: 'failure' | |
| # Fires when the canary job exits green but JSR or the gotrue-js legacy mirror | |
| # publish failed. release-canary.ts swallows those errors so npm canary still | |
| # ships; this notification ensures the breakage doesn't go silent for weeks. | |
| notify-canary-partial-failure: | |
| name: Notify Slack for Canary partial failure | |
| needs: release-canary | |
| if: ${{ always() && github.event_name == 'push' && needs.release-canary.result == 'success' && needs.release-canary.outputs.partial_failure == 'true' }} | |
| uses: ./.github/workflows/slack-notify.yml | |
| secrets: | |
| SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }} | |
| with: | |
| title: 'Canary Release: partial publish failure (${{ needs.release-canary.outputs.partial_failure_reason }})' | |
| status: 'partial' | |
| notify-next-failure: | |
| name: Notify Slack for Next failure | |
| needs: release-next | |
| if: ${{ always() && github.event_name == 'workflow_dispatch' && needs.release-next.result == 'failure' }} | |
| uses: ./.github/workflows/slack-notify.yml | |
| secrets: | |
| SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }} | |
| with: | |
| title: 'Next Prerelease' | |
| status: 'failure' | |
| notify-next-success: | |
| name: Notify Slack for Next success | |
| needs: release-next | |
| if: ${{ github.event_name == 'workflow_dispatch' && needs.release-next.result == 'success' }} | |
| uses: ./.github/workflows/slack-notify.yml | |
| secrets: | |
| SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }} | |
| with: | |
| title: 'Next Prerelease' | |
| status: 'success' |