layers/.github/workflows/release.yml at main · stainless-code/layers · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
# [Changesets](https://github.com/changesets/changesets): open a "Version packages" PR when
# `.changeset/*.md` files land on `main`, then publish to npm when that PR merges via npm
# trusted publishing (GitHub OIDC — no NPM_TOKEN; provenance auto-generated).
# Git auth: GitHub App install token — see CONTRIBUTING.md § Releases.
name: Release

on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: write
  pull-requests: write
  id-token: write

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    environment: release
    steps:
      - name: Require Release GitHub App credentials
        if: ${{ vars.RELEASE_APP_CLIENT_ID == '' }}
        run: |
          echo "::error::Missing vars.RELEASE_APP_CLIENT_ID (and secret RELEASE_APP_PRIVATE_KEY) on the \`release\` environment. See .github/CONTRIBUTING.md § Releases."
          exit 1

      - name: Create GitHub App token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write
          permission-workflows: write

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0
          persist-credentials: false
          token: ${{ steps.app-token.outputs.token }}

      - name: Setup Bun and install
        uses: ./.github/actions/setup

      # npm trusted publishing (OIDC) needs npm ≥ 11.5.1 + Node ≥ 22.14
      # (docs.npmjs.com/trusted-publishers). setup-bun leaves the runner's
      # npm 10.x in PATH → `npm publish` can't detect OIDC → ENEEDAUTH.
      # Node 24 ships npm 11.x; npm then auto-authenticates via OIDC (no token).
      - name: Setup Node + npm for trusted publishing
        uses: actions/setup-node@v6
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      # Opens/updates the Version PR when `.changeset/*.md` exist; otherwise publishes
      # unpublished versions. Failures: step log (App credentials, OIDC, registry).
      - name: Create Release Pull Request or Publish to npm
        id: changesets
        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1
        with:
          # Runs `changeset version` then oxfmt on CHANGELOG.md so `format:check` passes.
          version: bun run version
          publish: bun run release
          title: "chore: version packages"
          commit: "chore: version packages"
          createGithubReleases: true
          commitMode: github-api
          github-token: ${{ steps.app-token.outputs.token }}
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}