ping-javascript-sdk/.github/workflows/publish.yml at 232ee41993dd801b5da18af011ebeb06db0c2e68 · ForgeRock/ping-javascript-sdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
name: Publish
on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      branch:
        description: 'Branch/ref to publish from'
        required: false
        default: 'main'
        type: string
      dist_tag:
        description: 'npm dist-tag'
        required: false
        default: 'beta'
        type: string
      prerelease:
        description: 'changesets prerelease tag (beta/canary)'
        required: false
        default: 'beta'
        type: string
      access:
        description: 'npm access'
        required: false
        default: 'public'
        type: string
env:
  NX_CLOUD_ENCRYPTION_KEY: ${{ secrets.NX_CLOUD_ENCRYPTION_KEY }}
  NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
  PNPM_CACHE_FOLDER: .pnpm-store
  CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
  CI: true

jobs:
  publish-or-pr:
    if: github.event_name == 'push'
    permissions:
      contents: write
      issues: write
      pull-requests: write
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GH_TOKEN }}

      - name: Setup Project
        uses: ./.github/actions/setup
        with:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

      - run: npm install npm@latest -g
      - run: npm --version

      - name: publish
        uses: changesets/action@v1
        id: changesets
        with:
          publish: pnpm ci:release
          version: pnpm ci:version
          title: Release PR
          branch: main
          commit: 'chore: version-packages'
          setupGitUser: true
        env:
          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}

      - name: Publish Release Steps
        if: steps.changesets.outputs.published == 'true'
        uses: ./.github/actions/publish-release
        with:
          publishedPackages: ${{ steps.changesets.outputs.publishedPackages }}
          slackWebhook: ${{ secrets.SLACK_WEBHOOK_URL }}

      - name: Publish Beta Steps
        if: steps.changesets.outputs.published == 'false'
        uses: ./.github/actions/publish-beta

      - name: Calculate baseline bundle sizes
        run: |
          chmod +x ./scripts/bundle-sizes.sh
          rm -f previous_sizes.json
          echo "📊 Calculating fresh baseline bundle sizes for main branch"
          ./scripts/bundle-sizes.sh
          echo "✅ Baseline bundle sizes calculated"
          cat previous_sizes.json

      - name: Upload baseline bundle sizes
        uses: actions/upload-artifact@v5
        with:
          name: bundle-size-baseline
          path: previous_sizes.json
          retention-days: 30

  snapshot:
    # Guard against publishing snapshots from the protected release branch.
    # Both github.ref (the branch selected in the UI) and inputs.branch (the
    # free-text checkout ref) must be checked, since they are independent values
    # and the checkout step uses inputs.branch directly.
    if: >-
      ${{
        github.event_name == 'workflow_dispatch' &&
        github.ref != 'refs/heads/changeset-release/main' &&
        github.event.inputs.branch != 'changeset-release/main' &&
        github.event.inputs.branch != 'refs/heads/changeset-release/main'
      }}
    name: Publish Snapshots
    permissions:
      contents: write
      id-token: write
      issues: write
      pull-requests: write
    runs-on: ubuntu-latest
    env:
      HUSKY: 0
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GH_TOKEN }}
          ref: ${{ inputs.branch }}

      - name: Setup Project
        uses: ./.github/actions/setup
        with:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

      - name: Version Packages as prerelease
        run: pnpm changeset version --snapshot ${{ inputs.prerelease }}
        env:
          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}

      - name: Build all packages (skip cache)
        run: pnpm nx run-many -t build --no-agents --skip-nx-cache

      # The actual npm publish that must occur in the authorized file
      - name: Publish packages with dist-tag
        run: pnpm publish -r --tag ${{ inputs.dist_tag }} --no-git-checks --access ${{ inputs.access }}