publish.yml

# Publish
#
# Cross-publish package to GitHub Package Registry and NPM when a GitHub release is published or on
# workflow dispatch.
#
# References:
#
# - https://docs.github.com/actions/learn-github-actions/contexts
# - https://docs.github.com/actions/learn-github-actions/expressions
# - https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#release
# - https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch
# - https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions
# - https://docs.github.com/webhooks-and-events/webhooks/webhook-events-and-payloads#release
# - https://docs.github.com/webhooks-and-events/webhooks/webhook-events-and-payloads#workflow_dispatch
# - https://docs.npmjs.com/generating-provenance-statements
# - https://github.com/actions/checkout
# - https://github.com/actions/setup-node
# - https://github.com/actions/setup-node/blob/main/docs/advanced-usage.md#yarn2-configuration
# - https://github.com/hmarr/debug-action

---
name: publish
on:
  release:
    types:
      - published
  workflow_dispatch:
    inputs:
      tag:
        description: release tag
        required: true
        type: string
concurrency:
  cancel-in-progress: true
  group: ${{ github.workflow }}-${{ inputs.tag || github.ref_name }}
jobs:
  preflight:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    outputs:
      command: ${{ steps.command.outputs.result }}
      version: ${{ steps.version.outputs.result }}
    steps:
      - id: debug
        name: Print environment variables and event payload
        uses: hmarr/debug-action@v3.0.0
      - id: checkout
        name: Checkout ${{ github.ref_name }}
        uses: actions/checkout@v4.2.2
        with:
          persist-credentials: false
          ref: ${{ github.ref }}
      - id: version
        name: Get package version
        run: echo "result=$(jq .version package.json -r)" >>$GITHUB_OUTPUT
      - id: artifact
        name: Get release artifact download URL
        run: |
          echo "result=${{ github.event_name == 'release' && github.event.release.assets[0].browser_download_url || format('{0}/{1}/releases/download/{2}/%40{3}-{4}-{5}.tgz', github.server_url, github.repository, inputs.tag || github.ref_name, github.repository_owner, github.event.repository.name, steps.version.outputs.result) }}" >>$GITHUB_OUTPUT
      - id: dist-tag
        name: Get dist tag
        uses: flex-development/dist-tag-action@1.1.2
        with:
          target: ${{ steps.version.outputs.result }}
      - id: command
        name: Get publish command
        env:
          ARTIFACT: ${{ steps.artifact.outputs.result }}
          FLAGS: ${{ steps.dist-tag.outputs.flag }}
        run: echo "result=npm publish --provenance $FLAGS $ARTIFACT" >>$GITHUB_OUTPUT
  gpr:
    needs: preflight
    permissions:
      contents: read
      id-token: write
      packages: write
    runs-on: ubuntu-latest
    environment:
      name: gpr
      url: |
        ${{ format('{0}/{1}/pkgs/npm/{2}', github.server_url, github.repository, github.event.repository.name) }}
    steps:
      - id: checkout
        name: Checkout ${{ github.ref_name }}
        uses: actions/checkout@v4.2.2
        with:
          persist-credentials: false
          ref: ${{ github.ref }}
      - id: npmrc-cleanup
        name: Remove stale .npmrc file
        run: rm .npmrc
      - id: npmrc
        name: Setup .npmrc file
        uses: actions/setup-node@v4.1.0
        with:
          always-auth: true
          node-version-file: .nvmrc
          registry-url: https://npm.pkg.github.com
          scope: ${{ github.repository_owner }}
      - id: npmrc-print
        name: Print contents of .npmrc file
        run: cat $NPM_CONFIG_USERCONFIG
      - id: publish
        name: Publish package
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ${{ needs.preflight.outputs.command }}
  npm:
    needs:
      - gpr
      - preflight
    permissions:
      contents: read
      id-token: write
      packages: write
    runs-on: ubuntu-latest
    environment:
      name: npm
      url: |
        ${{ format('https://npmjs.com/package/@{0}/v/{1}', github.repository, needs.preflight.outputs.version) }}
    steps:
      - id: checkout
        name: Checkout ${{ github.ref_name }}
        uses: actions/checkout@v4.2.2
        with:
          persist-credentials: false
          ref: ${{ github.ref }}
      - id: npmrc-cleanup
        name: Remove stale .npmrc file
        run: rm .npmrc
      - id: npmrc
        name: Setup .npmrc file
        uses: actions/setup-node@v4.1.0
        with:
          always-auth: true
          node-version-file: .nvmrc
          registry-url: https://registry.npmjs.org
          scope: ${{ github.repository_owner }}
      - id: npmrc-print
        name: Print contents of .npmrc file
        run: cat $NPM_CONFIG_USERCONFIG
      - id: publish
        name: Publish package
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: ${{ needs.preflight.outputs.command }}