ci: use write permissions for release workflow #20
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - develop | |
| - main | |
| workflow_dispatch: | |
| env: | |
| CACHE_KEY: ${{ github.sha }}-${{ github.run_number }}-${{ github.run_attempt }} | |
| CACHE_PATH: ./* | |
| jobs: | |
| release: | |
| permissions: | |
| contents: write | |
| runs-on: ubuntu-latest | |
| name: release:${{ github.ref_name == 'main' && 'main' || 'develop' }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v2 | |
| with: | |
| version: 8.10.0 | |
| - name: Setup node.js | |
| uses: actions/setup-node@v3 | |
| with: | |
| cache: pnpm | |
| node-version: 20.9.0 | |
| - name: Cache | |
| uses: actions/cache@v3 | |
| with: | |
| key: ${{ env.CACHE_KEY }} | |
| path: ${{ env.CACHE_PATH }} | |
| - name: Build | |
| run: | | |
| pnpm install --frozen-lockfile --prefer-offline | |
| pnpm run build | |
| - name: Setup npm registry | |
| run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" >> "$HOME/.npmrc" | |
| - name: Canary release | |
| if: github.ref_name == 'develop' | |
| run: | | |
| pnpm changeset version --snapshot next | |
| pnpm changeset publish --tag next --no-git-tag | |
| - name: Stable release | |
| if: github.ref_name == 'main' | |
| run: | | |
| pnpm changeset version | |
| pnpm changeset publish --no-git-tag | |
| pnpm install | |
| - name: Commit changes | |
| if: github.ref_name == 'main' | |
| run: | | |
| git config user.name "GitHub Actions" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add . | |
| git diff-index --quiet HEAD || git commit -m "chore: release" | |
| - name: Create git tags | |
| if: github.ref_name == 'main' | |
| run: | | |
| pnpm changeset tag | |
| - name: Push changes | |
| if: github.ref_name == 'main' | |
| run: | | |
| git push origin main | |
| git push origin main --tags | |
| - name: Rebase develop onto main | |
| if: github.ref_name == 'main' | |
| run: | | |
| git checkout main | |
| git pull | |
| git checkout develop | |
| git pull | |
| git rebase main | |
| git push |