alpha-npm.yml

name: Alpha to NPM Registry

on:
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

# Allow only one concurrent deployment,but do NOT cancel in-progress runs as
# we want to allow these alpha deployments to complete.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read
  id-token: write # necessary for NPM provenance

jobs:
  publish-alpha-npm:
    name: NPM Publish
    runs-on: ubuntu-latest

    env:
      # Packages not listed here will be excluded from publishing
      PACKAGES: "agent api common credentials crypto crypto-aws-kms dids identity-agent proxy-agent user-agent"

    steps:
      - name: Checkout source
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1

      # https://cashapp.github.io/hermit/usage/ci/
      - name: Init Hermit
        uses: cashapp/activate-hermit@31ce88b17a84941bb1b782f1b7b317856addf286 #v1.1.0
        with:
          cache: "true"

      - name: Store NPM Registry Settings to .npmrc
        run: |
          echo -e "//registry.npmjs.org/:_authToken=\${NODE_AUTH_TOKEN}" > ~/.npmrc

      # Note - this is not required but it gives a clean failure prior to attempting a release if
      # the GH workflow runner is not authenticated with NPMjs.com
      - name: Verify NPM token is authenticated with NPMjs.com
        env:
          NODE_AUTH_TOKEN: ${{secrets.npm_token}}
        run: pnpm whoami

      - name: Print Node.js, npm, & pnpm versions for debugging if needed
        run: |
          node -v
          npm -v
          pnpm -v

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Generate alpha prerelease and bump package.json @web5/* versions
        env:
          NODE_AUTH_TOKEN: ${{secrets.npm_token}}
        run: |
          SHORT_COMMIT_SHA=$(git rev-parse --short HEAD)
          YYYYMMDD=$(date +'%Y%m%d')
          ALPHA_PRERELEASE="alpha-$YYYYMMDD-$SHORT_COMMIT_SHA"
          node ./scripts/bump-workspace.mjs --prerelease=$ALPHA_PRERELEASE
        shell: bash

      - name: Build the crypto package first
        env:
          NODE_AUTH_TOKEN: ${{secrets.npm_token}}
        run: pnpm --filter @web5/crypto build

      - name: Build all workspace packages
        env:
          NODE_AUTH_TOKEN: ${{secrets.npm_token}}
        run: pnpm --recursive --stream build

      - name: Publish selected @web5/* packages
        env:
          NODE_AUTH_TOKEN: ${{secrets.npm_token}}
        run: |
          for package in $PACKAGES; do
            cd packages/$package
            pnpm publish --tag alpha --access public --provenance --no-git-checks
            cd ../..
          done
        shell: bash