🚀 ci(publishing): Updating publishing workflows for manual publish parity

.github/workflows/publish-android.yaml

@@ -11,6 +11,10 @@ on:
       tag:
         description: 'Existing release tag (e.g. v1.2.3)'
         required: true
+      publish:
+        description: 'Actually publish'
+        type: boolean
+        default: false
 
 jobs:
   publish:
@@ -51,11 +55,22 @@ jobs:
 
       - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
 
+      - name: Verify Maven publishing assembles
+        if: github.event_name == 'workflow_dispatch' && !inputs.publish
+        working-directory: packages/android/ContentfulOptimization
+        env:
+          RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+        run: |
+          ./gradlew publishToMavenLocal \
+            -Pcontentful.optimization.version="$RELEASE_VERSION" \
+            --no-configuration-cache --no-daemon --console=plain
+
       # Build the signed AAR (+ sources/javadoc/POM) and publish+release it to Maven Central via the
       # Sonatype Central Portal. vanniktech reads credentials and the in-memory GPG key from the
       # ORG_GRADLE_PROJECT_* env vars below, populated from the Actions secrets that
       # scripts/setup-maven-central-credential.sh provisions.
       - name: Publish to Maven Central
+        if: github.event_name == 'release' || inputs.publish
         working-directory: packages/android/ContentfulOptimization
         env:
           ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}

.github/workflows/publish-npm.yaml

@@ -23,6 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Retrieve Secrets from Vault
+        if: github.event_name == 'release' || inputs.publish
         id: vault
         uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
         with:
@@ -45,7 +46,7 @@ jobs:
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: ${{ github.event_name == 'release' && github.event.release.tag_name || github.sha }}
+          ref: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.tag }}
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -86,6 +87,7 @@ jobs:
           retention-days: 3
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        if: github.event_name == 'release' || inputs.publish
         with:
           node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'

.github/workflows/publish-spm.yaml

@@ -11,6 +11,10 @@ on:
       tag:
         description: 'Existing release tag (e.g. v1.2.3)'
         required: true
+      publish:
+        description: 'Actually publish'
+        type: boolean
+        default: false
 
 jobs:
   publish:
@@ -61,6 +65,7 @@ jobs:
           test -f "$RUNNER_TEMP/pkg/Sources/ContentfulOptimization/Resources/optimization-ios-bridge.umd.js"
 
       - name: Set up the deploy key for SSH push
+        if: github.event_name == 'release' || inputs.publish
         env:
           MIRROR_DEPLOY_KEY: ${{ secrets.SPM_MIRROR_DEPLOY_KEY }}
         run: |
@@ -70,6 +75,7 @@ jobs:
           ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
 
       - name: Commit, tag, and push to the distribution repo
+        if: github.event_name == 'release' || inputs.publish
         run: |
           git clone --depth 1 git@github.com:contentful/optimization.swift.git mirror
           # --delete so files removed in the monorepo also disappear from the mirror

.husky/pre-commit

@@ -1,3 +1,12 @@
 #!/bin/bash
 
-pnpm exec lint-staged --allow-empty
+set -e
+
+LINT_STAGED="node_modules/.bin/lint-staged"
+
+if [ ! -x "$LINT_STAGED" ]; then
+  echo "lint-staged is not installed. Run 'pnpm install --frozen-lockfile' before committing."
+  exit 1
+fi
+
+"$LINT_STAGED" --allow-empty