[ACS-10765] Switch to NPM trusted publishing (#11388)

* [ACS-10765] Switch to NPM trusted publishing

* [ACS-10765] CR fixes

* [ACS-10765] Set NPM_TAG without github env usage

* [ACS-10765] CR fixes

* [ACS-10765] CR fix
This commit is contained in:
Michal Kinas
2025-11-27 13:27:16 +01:00
committed by GitHub
parent 533bf89b18
commit 91447f8646
8 changed files with 52 additions and 142 deletions
+15 -11
View File
@@ -23,6 +23,10 @@ on:
- develop-patch*
- master-patch*
permissions:
id-token: write # Required for OIDC
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: false
@@ -34,12 +38,11 @@ env:
GH_BUILD_NUMBER: ${{ github.run_id }}
LOG_LEVEL: "ERROR"
NODE_OPTIONS: "--max-old-space-size=5120"
GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
jobs:
setup:
timeout-minutes: 20
if: github.event.pull_request.merged == true || github.ref_name == 'master' || github.ref_name == 'master-patch-*'
if: github.event.pull_request.merged == true || github.ref_name == 'master' || github.ref_name == 'master-patch-*' || github.event_name == 'workflow_dispatch'
name: "Setup"
runs-on: ubuntu-latest
steps:
@@ -62,9 +65,10 @@ jobs:
outputs:
release_version: ${{ steps.set-version.outputs.release_version }}
timeout-minutes: 30
if: github.event.pull_request.merged == true || github.ref_name == 'master' || github.ref_name == 'master-patch-*'
if: github.event.pull_request.merged == true || github.ref_name == 'master' || github.ref_name == 'master-patch-*' || github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
permissions:
id-token: write # Required for OIDC
contents: read
packages: write
steps:
@@ -72,7 +76,8 @@ jobs:
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
with:
fetch-depth: 0
- uses: ./.github/actions/setup
- id: setup
uses: ./.github/actions/setup
with:
enable-node-modules-cache: false
- id: set-dryrun
@@ -101,22 +106,21 @@ jobs:
node-version-file: '.nvmrc'
registry-url: 'https://npm.pkg.github.com'
scope: '@alfresco'
- run: npm run publish -- --tag=$TAG_NPM || exit 1
- run: npm run publish -- --tag=${{ steps.setup.outputs.npm-tag }}
env:
NODE_AUTH_TOKEN: ${{ secrets.PAT_WRITE_PKG }}
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
name: release libraries Npm registry
with:
node-version-file: '.nvmrc'
registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}'
scope: '@alfresco'
- run: npm run publish -- --tag=$TAG_NPM || exit 1
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
- run: npm run publish -- --tag=${{ steps.setup.outputs.npm-tag }}
create-git-tag:
runs-on: ubuntu-latest
needs: [setup, release-npm]
if: github.event_name != 'workflow_dispatch'
name: Create github tag
permissions:
contents: write
@@ -152,7 +156,7 @@ jobs:
npm-check-bundle:
needs: [release-npm]
timeout-minutes: 15
if: github.event.pull_request.merged == true || github.ref_name == 'master' || github.ref_name == 'master-patch-*'
if: github.event.pull_request.merged == true || github.ref_name == 'master' || github.ref_name == 'master-patch-*' || github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
steps:
- name: Checkout repository
@@ -161,7 +165,7 @@ jobs:
push-translation-keys-to-crowdin:
name: Push translations keys to Crowdin
if: ${{ github.ref == 'refs/heads/develop' }}
if: github.ref_name == 'develop' && github.event_name != 'workflow_dispatch'
runs-on: ubuntu-latest
needs: [setup]
permissions: