Skip to content

chore(ci): npm-publish via reusable workflows #75

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sheplu wants to merge 1 commit into
base: master
Choose a base branch
from
+102 −0
Open

chore(ci): npm-publish via reusable workflows #75

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
95 changes: 95 additions & 0 deletions .github/workflows/npm-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,95 @@
name: Publish package to npm

on:
release:
types: [created]

concurrency:
group: "${{ github.workflow }} ✨ ${{ github.ref }}"
cancel-in-progress: false

permissions:
contents: read

jobs:
audit:
name: Audit production dependencies
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false

- name: Setup Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: "lts/*"

- name: Audit production dependencies
run: npm audit --omit=dev

lint:
name: Lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false

- name: Setup Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: "lts/*"

- name: Install dependencies
run: npm install --ignore-scripts --include=dev

- name: Run lint
run: node --run lint

test:
name: Test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false

- name: Setup Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: "lts/*"

- name: Install dependencies
run: npm install

- name: Run tests
run: npm test
Comment on lines +15 to +67

@UlisesGascon UlisesGascon Jun 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
audit:
name: Audit production dependencies
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false
- name: Setup Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: "lts/*"
- name: Audit production dependencies
run: npm audit --omit=dev
lint:
name: Lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false
- name: Setup Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: "lts/*"
- name: Install dependencies
run: npm install --ignore-scripts --include=dev
- name: Run lint
run: node --run lint
test:
name: Test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false
- name: Setup Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: "lts/*"
- name: Install dependencies
run: npm install
- name: Run tests
run: npm test

To be honest when I publish locally I don't run scripts or install dependencies (unless it is strict requirement like a build process for typescript, etc...). Avoiding that also in the CI we reduce noice and attack surface. We can assume that once a release is created in the repo the source code is stable to ship.

Also audit dependencies is not that relevant as this stage as we don't ship the lockfile, so that audit report won't be idempotent.


publish:
name: Publish to npm
needs: [audit, lint, test]
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false

- name: Setup Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: "lts/*"
registry-url: "https://registry.npmjs.org"

# npm stage publish requires npm >= 11.15.0
- name: Upgrade npm
run: npm install -g npm@latest

- name: Install dependencies
run: npm install --ignore-scripts
Comment on lines +91 to +92

@UlisesGascon UlisesGascon Jun 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- name: Install dependencies
run: npm install --ignore-scripts

We can skip this :)


- name: Stage publish to npm
run: npm stage publish
7 changes: 7 additions & 0 deletions .npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
allow-file=none
allow-remote=none
allow-git=none
allow-directory=none

min-release-age=2

@UlisesGascon UlisesGascon Jun 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
min-release-age=2
min-release-age=7

I will go for a week, if something is really urgent or critical we will notice and always can manually upgrade. Given the amount of volume in the recent supply chain attacks maybe 2d won't be sustainable long term (specially on large holidays period). One week seems solid IMO

save-exact=false
Loading