|
| 1 | +name: "Publish: Package" |
| 2 | + |
| 3 | +on: |
| 4 | + workflow_call: |
| 5 | + inputs: |
| 6 | + package: |
| 7 | + description: "Package" |
| 8 | + type: string |
| 9 | + required: true |
| 10 | + registry: |
| 11 | + description: "Registry" |
| 12 | + type: string |
| 13 | + default: 'https://registry.npmjs.org' |
| 14 | + dry-run: |
| 15 | + description: "Dry Run" |
| 16 | + type: boolean |
| 17 | + default: false |
| 18 | + release: |
| 19 | + description: "Release to GitHub" |
| 20 | + type: boolean |
| 21 | + default: false |
| 22 | + tag: |
| 23 | + description: "Release: Tag" |
| 24 | + type: string |
| 25 | + draft: |
| 26 | + description: "Release: Draft" |
| 27 | + type: boolean |
| 28 | + prerelease: |
| 29 | + description: "Release: Pre-release" |
| 30 | + type: boolean |
| 31 | + release-name: |
| 32 | + description: "Release: Name" |
| 33 | + type: string |
| 34 | + release-generate: |
| 35 | + description: "Release: Generate Notes" |
| 36 | + type: boolean |
| 37 | + release-latest: |
| 38 | + description: "Release: Latest" |
| 39 | + type: boolean |
| 40 | + |
| 41 | + secrets: |
| 42 | + PUBLISH_TOKEN: |
| 43 | + description: "Publishing Token" |
| 44 | + required: true |
| 45 | + |
| 46 | + workflow_dispatch: |
| 47 | + inputs: |
| 48 | + package: |
| 49 | + description: "Package" |
| 50 | + type: choice |
| 51 | + required: true |
| 52 | + options: |
| 53 | + - java |
| 54 | + - maven |
| 55 | + - gradle |
| 56 | + - indexer |
| 57 | + dry-run: |
| 58 | + description: "Dry Run" |
| 59 | + type: boolean |
| 60 | + default: false |
| 61 | + registry: |
| 62 | + description: "Registry" |
| 63 | + type: string |
| 64 | + default: 'https://registry.npmjs.org' |
| 65 | + release: |
| 66 | + description: "Release to GitHub" |
| 67 | + type: boolean |
| 68 | + default: false |
| 69 | + tag: |
| 70 | + description: "Release Tag" |
| 71 | + type: string |
| 72 | + draft: |
| 73 | + description: "Release: Draft" |
| 74 | + type: boolean |
| 75 | + prerelease: |
| 76 | + description: "Release: Pre-release" |
| 77 | + type: boolean |
| 78 | + release-name: |
| 79 | + description: "Release: Name" |
| 80 | + type: string |
| 81 | + release-generate: |
| 82 | + description: "Release: Generate Notes" |
| 83 | + type: boolean |
| 84 | + release-latest: |
| 85 | + description: "Release: Latest" |
| 86 | + type: boolean |
| 87 | + |
| 88 | +jobs: |
| 89 | + build: |
| 90 | + name: "Package: Build (${{ inputs.package }})" |
| 91 | + runs-on: ubuntu-latest |
| 92 | + outputs: |
| 93 | + hashes: ${{ steps.hash.outputs.hashes }} |
| 94 | + permissions: |
| 95 | + contents: read |
| 96 | + id-token: write |
| 97 | + steps: |
| 98 | + - name: "Setup: Harden Runner" |
| 99 | + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 |
| 100 | + with: |
| 101 | + egress-policy: audit |
| 102 | + - name: "Setup: Checkout" |
| 103 | + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 |
| 104 | + with: |
| 105 | + persist-credentials: false |
| 106 | + - name: "Setup: Node" |
| 107 | + uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 |
| 108 | + with: |
| 109 | + node-version: ${{ vars.NODE_VERSION || '21' }} |
| 110 | + registry-url: 'https://registry.npmjs.org' |
| 111 | + - name: "Setup: PNPM" |
| 112 | + uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0 |
| 113 | + with: |
| 114 | + version: ${{ vars.PNPM_VERSION || '8' }} |
| 115 | + run_install: | |
| 116 | + - recursive: true |
| 117 | + args: [--frozen-lockfile, --strict-peer-dependencies] |
| 118 | + - name: "Build: Package (${{ inputs.package }})" |
| 119 | + run: cd packages/${{ inputs.package }} && pnpm pack |
| 120 | + - name: "Build: Provenance Hashes" |
| 121 | + shell: bash |
| 122 | + id: hash |
| 123 | + run: | |
| 124 | + echo "Release assets:" |
| 125 | + ls -la packages/*/*.tgz |
| 126 | + file packages/*/*.tgz |
| 127 | + du -h packages/*/*.tgz |
| 128 | + echo "" |
| 129 | +
|
| 130 | + sha256sum packages/*/*.tgz > ./packages/${{ inputs.package }}/pkg-hashes.txt |
| 131 | + echo "Hashes:" |
| 132 | + cat ./packages/${{ inputs.package }}/pkg-hashes.txt |
| 133 | + echo "" |
| 134 | +
|
| 135 | + cat ./packages/${{ inputs.package }}/pkg-hashes.txt | base64 -w0 > ./packages/${{ inputs.package }}/pkg-hashes-encoded.txt |
| 136 | + echo "Encoded Hashes:" |
| 137 | + cat ./packages/${{ inputs.package }}/pkg-hashes-encoded.txt |
| 138 | + echo "" |
| 139 | +
|
| 140 | + echo "hashes=$(cat ./packages/${{ inputs.package }}/pkg-hashes-encoded.txt)" >> "$GITHUB_OUTPUT" |
| 141 | + - name: "Artifact: Packages" |
| 142 | + uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1 |
| 143 | + with: |
| 144 | + name: javamodules-pkg-${{ inputs.package }}-${{ github.sha }} |
| 145 | + retention-days: 30 |
| 146 | + compression-level: 1 |
| 147 | + overwrite: true |
| 148 | + path: | |
| 149 | + packages/${{ inputs.package }}/*.tgz |
| 150 | + packages/${{ inputs.package }}/pkg-hashes.txt |
| 151 | + packages/${{ inputs.package }}/pkg-hashes-encoded.txt |
| 152 | +
|
| 153 | + provenance: |
| 154 | + name: "SLSA Provenance (${{ inputs.package }})" |
| 155 | + needs: [build] |
| 156 | + uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected] |
| 157 | + permissions: |
| 158 | + actions: read |
| 159 | + id-token: write |
| 160 | + contents: write |
| 161 | + with: |
| 162 | + base64-subjects: "${{ needs.build.outputs.hashes }}" |
| 163 | + upload-assets: true |
| 164 | + |
| 165 | + release: |
| 166 | + name: "Release to GitHub (${{ inputs.package }})" |
| 167 | + needs: [build, provenance] |
| 168 | + runs-on: ubuntu-latest |
| 169 | + if: startsWith(github.ref, 'refs/tags/') || inputs.release |
| 170 | + steps: |
| 171 | + - name: "Artifact: Package" |
| 172 | + id: releaseArtifact |
| 173 | + uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4 |
| 174 | + with: |
| 175 | + name: javamodules-pkg-${{ inputs.package }}-${{ github.sha }} |
| 176 | + - name: "Artifact: Provenance" |
| 177 | + id: provenanceArtifact |
| 178 | + uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4 |
| 179 | + with: |
| 180 | + name: ${{ needs.provenance.outputs.provenance-name }} |
| 181 | + - name: "Publish: Release" |
| 182 | + uses: softprops/action-gh-release@d99959edae48b5ffffd7b00da66dcdb0a33a52ee # v2.0.2 |
| 183 | + with: |
| 184 | + draft: ${{ inputs.draft }} |
| 185 | + prerelease: ${{ inputs.prerelease }} |
| 186 | + name: ${{ inputs.release-name }} |
| 187 | + tag_name: ${{ inputs.tag || github.ref }} |
| 188 | + generate_release_notes: ${{ inputs.release-generate }} |
| 189 | + append_body: true |
| 190 | + files: | |
| 191 | + ${{ steps.releaseArtifact.outputs.download-path }} |
| 192 | + ${{ steps.provenanceArtifact.outputs.download-path }} |
| 193 | +
|
| 194 | + publish-npm: |
| 195 | + name: "Publish to Registry (${{ inputs.package }})" |
| 196 | + needs: [build, provenance, release] |
| 197 | + runs-on: ubuntu-latest |
| 198 | + if: startsWith(github.ref, 'refs/tags/') || inputs.release |
| 199 | + permissions: |
| 200 | + id-token: write |
| 201 | + contents: write |
| 202 | + packages: write |
| 203 | + steps: |
| 204 | + - name: "Artifact: Package" |
| 205 | + id: releaseArtifact |
| 206 | + uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4 |
| 207 | + with: |
| 208 | + name: javamodules-pkg-${{ inputs.package }}-${{ github.sha }} |
| 209 | + - name: "Artifact: Provenance" |
| 210 | + id: provenanceArtifact |
| 211 | + uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4 |
| 212 | + with: |
| 213 | + name: ${{ needs.provenance.outputs.provenance-name }} |
| 214 | + - name: "Publish to Registry" |
| 215 | + run: cd packages/${{ inputs.package }} && pnpm run ${{ inputs.dry-run && 'publish:dry' || 'publish:live' }} --registry=${{ inputs.registry }} |
| 216 | + env: |
| 217 | + NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }} |
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
0 commit comments