Skip to content

Commit 54e7daf

Browse files
bernacodesidobernacodesido
committed
Modify to upload using OIDC
1 parent 61feff4 commit 54e7daf

File tree

1 file changed

+107
-116
lines changed

1 file changed

+107
-116
lines changed

‎.github/workflows/publish-npm.yml‎

Lines changed: 107 additions & 116 deletions
Original file line numberDiff line numberDiff line change
@@ -8,134 +8,125 @@ on:
88
permissions: read-all
99

1010
jobs:
11-
check-packages:
11+
publish:
12+
permissions:
13+
id-token: write
14+
contents: read
15+
1216
runs-on: ubuntu-latest
13-
outputs:
14-
matrix: ${{ steps.set-matrix.outputs.matrix }}
1517

1618
steps:
1719
- name: Checkout
18-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1921

20-
- name: "Check packages existence"
22+
- name: "Check file existence"
2123
id: check_files
2224
uses: andstor/file-existence-action@076e0072799f4942c8bc574a82233e1e4d13e9d6 # v3.0.0
2325
with:
24-
files: "package.json, README.md, packages/**/package.json"
26+
files: "package.json, README.md"
2527

26-
- name: Required files exist
28+
- name: File exists
2729
if: steps.check_files.outputs.files_exists != 'true'
30+
# Only runs if all of the files exists
31+
run: exit 1
32+
33+
- name: Get package.json package name and match with repository name
34+
run: |
35+
echo PACKAGE_NAME=$(cat package.json | jq -r .name | cut -f2 -d"\"" | cut -f2 -d"@") >> $GITHUB_OUTPUT
36+
echo PACKAGE_VERSION="refs/tags/v"$(cat package.json | jq -r .version) >> $GITHUB_OUTPUT
37+
echo PACKAGE_REPOSITORY=$(cat package.json | jq -r .repository.url | sed 's/\+https//') >> $GITHUB_OUTPUT
38+
id: get_package_info
39+
40+
- name: Print outputs for debugging
41+
run: |
42+
echo "GitHub Repository: ${{ github.repository }}"
43+
echo "Package Name: ${{ steps.get_package_info.outputs.PACKAGE_NAME }}"
44+
echo "Github Tag: ${{ github.ref }}"
45+
echo "Package Version: ${{ steps.get_package_info.outputs.PACKAGE_VERSION }}"
46+
echo "GitHub Repository URL: ${{ github.repositoryUrl }}"
47+
echo "Package Repository: ${{ steps.get_package_info.outputs.PACKAGE_REPOSITORY }}"
48+
49+
- name: Check if package_name matches with repository name
50+
if: github.repository != steps.get_package_info.outputs.PACKAGE_NAME
51+
# Fail if package name not properly configured
2852
run: exit 1
2953

30-
- name: Generate packages paths
31-
id: set-matrix
54+
- name: Check if package version matches with tag
55+
if: github.ref != steps.get_package_info.outputs.PACKAGE_VERSION
56+
# Fail if package version not properly setted
57+
run: exit 1
58+
59+
- name: Check if package repository matches with repository
60+
if: github.repositoryUrl != steps.get_package_info.outputs.PACKAGE_REPOSITORY
61+
# Fail if package repository doesn't match with repository
62+
run: exit 1
63+
64+
- name: Setup Node.js
65+
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af #v4.1.0
66+
with:
67+
node-version: 20
68+
registry-url: https://registry.npmjs.org
69+
70+
- name: Clean install dependencies
3271
run: |
33-
package_json_paths=()
34-
for dir in packages/*/; do
35-
folder_name="${dir%/}"
36-
package_json_paths+=("\"$folder_name\"")
37-
done
38-
json_list="[$(IFS=,; echo "${package_json_paths[*]}")]"
39-
echo "matrix=$json_list" >> "$GITHUB_OUTPUT"
40-
- run: |
41-
echo "${{ steps.set-matrix.outputs.matrix }}"
42-
43-
process-packages:
44-
needs: [check-packages]
45-
runs-on: ubuntu-latest
46-
strategy:
47-
matrix:
48-
package: ${{ fromJson(needs.check-packages.outputs.matrix) }}
49-
50-
steps:
51-
- name: Checkout
52-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
53-
- name: Process package
54-
run: |
55-
echo "Processing package: ${{ matrix.package }}"
56-
57-
- name: Get package.json package name and match with repository name
58-
run: |
59-
echo PACKAGE_NAME=$(cat ${{ matrix.package }}/package.json | jq -r .name | cut -f2 -d"\"" | cut -f2 -d"@") >> $GITHUB_OUTPUT
60-
echo PACKAGE_VERSION="refs/tags/v"$(cat ${{ matrix.package }}/package.json | jq -r .version) >> $GITHUB_OUTPUT
61-
echo PACKAGE_REPOSITORY=$(cat ${{ matrix.package }}/package.json | jq -r .repository.url | sed 's/\+https//') >> $GITHUB_OUTPUT
62-
id: get_package_info
63-
64-
- name: Print outputs for debugging
65-
run: |
66-
echo "GitHub Repository: ${{ github.repository }}"
67-
echo "Package Name: ${{ steps.get_package_info.outputs.PACKAGE_NAME }}"
68-
echo "Github Tag: ${{ github.ref }}"
69-
echo "Package Version: ${{ steps.get_package_info.outputs.PACKAGE_VERSION }}"
70-
echo "GitHub Repository URL: ${{ github.repositoryUrl }}"
71-
echo "Package Repository: ${{ steps.get_package_info.outputs.PACKAGE_REPOSITORY }}"
72-
73-
- name: Setup NodeJS
74-
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
75-
with:
76-
node-version-file: '.nvmrc'
77-
cache: 'npm'
78-
registry-url: https://registry.npmjs.org
79-
80-
# Install dependencies and build
81-
- name: Install dependencies and build
82-
run: |
83-
npm ci
84-
npm run build
85-
86-
- name: Pre upload validation
87-
id: pack
88-
run: |
89-
cd ${{ matrix.package }}
90-
npm pack --dry-run > output 2>&1
91-
PRE_UPLOAD_HASH=$(grep 'shasum' output | awk '{print $NF}')
92-
echo "PRE_UPLOAD_HASH=$PRE_UPLOAD_HASH" >> $GITHUB_OUTPUT
93-
echo "PRE_UPLOAD_HASH: $PRE_UPLOAD_HASH"
72+
rm -rf dist
73+
npm ci
74+
75+
- name: Update npm
76+
run: npm install -g npm@latest
77+
78+
- name: Build
79+
run: npm run build
80+
81+
- name: Pre upload validation
82+
id: pack
83+
run: |
84+
rm -f *.tgz
85+
PRE_UPLOAD_HASH=$(npm pack --dry-run 2>&1 | grep 'shasum:' | awk '{print $NF}')
86+
echo "PRE_UPLOAD_HASH=$PRE_UPLOAD_HASH" >> $GITHUB_OUTPUT
87+
echo "PRE_UPLOAD_HASH: $PRE_UPLOAD_HASH"
9488
95-
- name: Check if version is already published
96-
run: |
97-
PACKAGE_NAME=$(cat ${{ matrix.package }}/package.json | jq -r .name)
98-
PACKAGE_VERSION=$(cat ${{ matrix.package }}/package.json | jq -r .version)
99-
100-
if npm view $PACKAGE_NAME@$PACKAGE_VERSION > /dev/null 2>&1; then
101-
echo "Version $PACKAGE_VERSION of $PACKAGE_NAME is already published."
102-
exit 0
103-
fi
104-
105-
echo "Version $PACKAGE_VERSION of $PACKAGE_NAME is not published. Proceeding with publishing..."
106-
107-
- name: Upload package
108-
run: |
109-
cd ${{ matrix.package }}
110-
npm publish --access public
111-
env:
112-
NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
89+
- name: Check if version is already published
90+
run: |
91+
PACKAGE_NAME=$(cat package.json | jq -r .name)
92+
PACKAGE_VERSION=$(cat package.json | jq -r .version)
93+
94+
if npm view $PACKAGE_NAME@$PACKAGE_VERSION > /dev/null 2>&1; then
95+
echo "Version $PACKAGE_VERSION of $PACKAGE_NAME is already published."
96+
exit 0
97+
fi
98+
99+
echo "Version $PACKAGE_VERSION of $PACKAGE_NAME is not published. Proceeding with publishing..."
100+
101+
- name: Upload package
102+
run: npm publish
113103

114-
- name: Post upload validation
115-
id: unpack
116-
run: |
117-
# Get the package name and version
118-
PACKAGE_NAME=$(cat ${{ matrix.package }}/package.json | jq -r .name)
119-
PACKAGE_VERSION=$(cat ${{ matrix.package }}/package.json | jq -r .version)
120-
FULL_PACKAGE_NAME="${PACKAGE_NAME}@${PACKAGE_VERSION}"
121-
122-
# Wait for package propagation
123-
echo "Waiting for package propagation..."
124-
sleep 15
125-
126-
# Fetch the shasum from npm
127-
POST_UPLOAD_HASH=$(npm view $FULL_PACKAGE_NAME dist.shasum)
128-
echo "POST_UPLOAD_HASH=$POST_UPLOAD_HASH" >> $GITHUB_OUTPUT
129-
echo "POST_UPLOAD_HASH: $POST_UPLOAD_HASH"
130-
131-
- name: Pre and Post Upload validation
132-
run: |
133-
echo "Comparing hashes..."
134-
echo "PRE_UPLOAD_HASH: '${{ steps.pack.outputs.PRE_UPLOAD_HASH }}'"
135-
echo "POST_UPLOAD_HASH: '${{ steps.unpack.outputs.POST_UPLOAD_HASH }}'"
136-
137-
if [ "${{ steps.pack.outputs.PRE_UPLOAD_HASH }}" != "${{ steps.unpack.outputs.POST_UPLOAD_HASH }}" ]; then
138-
echo "Hash mismatch detected!"
139-
exit 1
140-
fi
141-
echo "Hashes match successfully!"
104+
- name: Post upload validation
105+
id: unpack
106+
run: |
107+
# Get the package name and version
108+
PACKAGE_NAME=$(cat package.json | jq -r .name)
109+
PACKAGE_VERSION=$(cat package.json | jq -r .version)
110+
FULL_PACKAGE_NAME="${PACKAGE_NAME}@${PACKAGE_VERSION}"
111+
112+
# Wait for package propagation
113+
echo "Waiting for package propagation..."
114+
sleep 15
115+
116+
# Fetch the shasum from npm
117+
POST_UPLOAD_HASH=$(npm view $FULL_PACKAGE_NAME dist.shasum)
118+
echo "POST_UPLOAD_HASH=$POST_UPLOAD_HASH" >> $GITHUB_OUTPUT
119+
echo "POST_UPLOAD_HASH: $POST_UPLOAD_HASH"
120+
121+
- name: Pre and Post Upload validation
122+
run: |
123+
echo "Comparing hashes..."
124+
echo "PRE_UPLOAD_HASH: '${{ steps.pack.outputs.PRE_UPLOAD_HASH }}'"
125+
echo "POST_UPLOAD_HASH: '${{ steps.unpack.outputs.POST_UPLOAD_HASH }}'"
126+
127+
if [ "${{ steps.pack.outputs.PRE_UPLOAD_HASH }}" != "${{ steps.unpack.outputs.POST_UPLOAD_HASH }}" ]; then
128+
echo "Hash mismatch detected!"
129+
exit 1
130+
fi
131+
echo "Hashes match successfully!"
132+

0 commit comments

Comments
 (0)