Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
75 changes: 23 additions & 52 deletions .github/workflows/publish.yml
Original file line number Diff line number Diff line change
@@ -1,77 +1,48 @@
# When making a release, please keep in mind that this action expects and validates a few things:
# When making a release, please keep in mind:
# - Releases marked as drafts will be ignored (ie. they will not publish).
# - Ensure that package.json has a version.
# - Ensure the git tag you create during the release process starts with a v (ie. v1.2.3).
# - Ensure that the version in package.json matches the release tag created.
# - Ensure versions are valid semver format.
# - Ensure the GitHub release is marked as a pre-release if the semver version has a pre-release tag.

# This script was inspired by this README: https://github.com/marketplace/actions/github-releases-for-automated-package-publishing

name: Publish Package to npmjs
on:
release:
types: [created]
permissions:
id-token: write
contents: read
env:
NODE_OPTIONS: "--max_old_space_size=4096"
jobs:
build:
publish:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

# Setup Node.js version first
- uses: actions/setup-node@v3
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
with:
node-version: "22.18.0"
node-version: "22.18"
always-auth: true
registry-url: "https://registry.npmjs.org"

# Note we set an `id` called `release`. We'll use that later...
- name: Validate and extract release information
id: release
uses: manovotny/github-releases-for-automated-package-publishing-action@v2.0.1

- name: Install dependencies
run: yarn install --frozen-lockfile

- name: Build
run: yarn build

cache: "yarn"
# Trusted Publishing requires npm >= 11.5.1
- name: Update npm
run: npm install -g npm@latest

- name: Log Node & npm versions (after update)
# Make sure we hit 11.5.1 version requirement for Trusted Publishing
- name: Log Node & npm versions
run: |
node -v
npm -v

# The last two steps will publish the package. Note that we're using
# information from the `release` step above (I told you we'd use it
# later). Notice the `if` statements on both steps...
#
# If there *is* a tag (ie. `beta`, `canary`, etc.), we publish a
# "pre-release" or "tagged" version of a package (ie. 1.2.3-beta.1).
#
# If there *is not* a tag (ie. `beta`, `canary`, etc.), we publish a
# version of a package (ie. 1.2.3).
#
# This example is using npm to publish, but you could just as easily
# use yarn, if you prefer. It's also publishing to the NPM registry,
# thus, it's using `NPM_TOKEN`, but you could just as easily use
# `GITHUB_TOKEN` if you were publishing to the GitHub Package registry.

# This will publish a "pre-release" or "tagged" version of a package.

# This will publish a version of a package.
- name: Publish version
if: steps.release.outputs.tag == ''
run: npm publish

- name: Publish tagged version
if: steps.release.outputs.tag != ''
run: npm publish --tag ${{ steps.release.outputs.tag }}
- run: yarn install --frozen-lockfile
- name: Determine publish tag
id: tag
run: |
VERSION=$(node -p "require('./package.json').version")

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Restore release/tag consistency validation before publish

This workflow now derives publish behavior only from package.json and no longer validates release metadata (tag/version match and prerelease alignment) before publishing. If a GitHub release is created with an incorrect tag or prerelease flag, the job will still publish the package version from the repo, which can publish an unintended version/channel and is difficult to undo in npm.

Useful? React with 👍 / 👎.

# Extract pre-release identifier (e.g. "beta" from "1.0.0-beta.1")
PRE=$(echo "$VERSION" | sed -n 's/.*-\([a-zA-Z]*\).*/\1/p')

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Parse prerelease tag from SemVer without truncating

The sed pattern only captures alphabetic characters after the last -, so valid prerelease versions such as 1.2.3-rc1.0 or 1.2.3-alpha-beta.1 are parsed incorrectly (rc / beta), and identifiers that begin with non-letters can become empty. In those cases, the publish step can fall back to plain npm publish and ship a prerelease as latest, which is a production-impacting channel mistake.

Useful? React with 👍 / 👎.

echo "pre=$PRE" >> "$GITHUB_OUTPUT"
- name: Publish
run: |
if [ -n "${{ steps.tag.outputs.pre }}" ]; then
npm publish --tag ${{ steps.tag.outputs.pre }}
else
npm publish
fi
2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@across-protocol/constants",
"version": "3.1.107",
"version": "3.1.108-alpha.0",
"description": "Export commonly re-used values for Across repositories",
"repository": {
"type": "git",
Expand Down