Bind OIDC publishing to protected environment #25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: npm-packages | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "v[0-9]+*" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| if: >- | |
| github.repository == 'WaveSpeedAI/wavespeed-javascript' && | |
| (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && | |
| (github.ref == 'refs/heads/main' || | |
| (github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v'))) | |
| environment: package-build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run linter | |
| run: npm run lint | |
| - name: Run tests | |
| run: npm test | |
| env: | |
| WAVESPEED_API_KEY: ${{ secrets.WAVESPEED_API_KEY }} | |
| - name: Build package | |
| run: npm run build | |
| - name: Pack package | |
| run: npm pack | |
| - run: ls -lh *.tgz | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: npm-packages | |
| path: | | |
| *.tgz | |
| # publish to GitHub Release | |
| gh_release: | |
| name: gh_release | |
| needs: build | |
| if: >- | |
| github.repository == 'WaveSpeedAI/wavespeed-javascript' && | |
| github.event_name == 'push' && | |
| (github.ref == 'refs/heads/main' || | |
| (github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v'))) | |
| environment: github-release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| timeout-minutes: 60 | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 | |
| with: | |
| path: dist | |
| - run: ls -R dist/ | |
| # create nightly release if it's a push to main | |
| - if: github.repository == 'WaveSpeedAI/wavespeed-javascript' && github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| name: Nightly Release | |
| uses: andelf/nightly-release@c5ed4bdb7c1da04a4fa1e40bc5e67306f682563b # v1 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| tag_name: nightly | |
| name: 'Nightly Release $$' | |
| prerelease: true | |
| body: 'TODO: Add nightly release notes' | |
| files: | | |
| dist/*/*.tgz | |
| # create release if it's a tag like vx.y.z | |
| - if: github.repository == 'WaveSpeedAI/wavespeed-javascript' && github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v') | |
| name: Release | |
| uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1 | |
| with: | |
| files: | | |
| dist/*/*.tgz |