Merge pull request #160 from block/chai/self-contained-release-tarball #106
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| id-token: write | |
| jobs: | |
| release: | |
| name: Version or publish | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| env: | |
| # `secrets` context can't be used in step-level `if:`, so surface a | |
| # presence flag here. Skips the tap bump on forks / unconfigured repos. | |
| HAS_TAP_APP: ${{ secrets.BLOCK_HOMEBREW_TAP_APP_ID != '' && secrets.BLOCK_HOMEBREW_TAP_PRIVATE_KEY != '' }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| registry-url: https://registry.npmjs.org | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm --filter @anarchitecture/ghost build | |
| - name: Create Release PR or publish | |
| id: changesets | |
| uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0 | |
| with: | |
| publish: pnpm changeset publish | |
| version: pnpm changeset version | |
| commit: "chore: version packages" | |
| title: "chore: version packages" | |
| createGithubReleases: false | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_TOKEN: ${{ secrets.GHOST_NPM_PUBLISH_TOKEN }} | |
| NODE_AUTH_TOKEN: ${{ secrets.GHOST_NPM_PUBLISH_TOKEN }} | |
| # Changesets publish emits the published package list and skips versions | |
| # already present on npm. Keep GitHub Releases owned here so Homebrew has | |
| # one stable, slash-free tag and a matching .tgz asset for each npm | |
| # publish. | |
| - name: Attach tarball to GitHub Release | |
| id: tarball | |
| if: steps.changesets.outputs.published == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PUBLISHED_PACKAGES: ${{ steps.changesets.outputs.publishedPackages }} | |
| run: | | |
| set -euo pipefail | |
| VERSION="$(echo "$PUBLISHED_PACKAGES" \ | |
| | python3 -c "import json,sys; pkgs=json.load(sys.stdin); print(next(p['version'] for p in pkgs if p['name']=='@anarchitecture/ghost'))")" | |
| TAG="anarchitecture-ghost@${VERSION}" | |
| mkdir -p dist-tarball | |
| node scripts/pack-release-tarball.mjs "$GITHUB_WORKSPACE/dist-tarball" | |
| ls -la dist-tarball | |
| if ! gh release view "$TAG" >/dev/null 2>&1; then | |
| gh release create "$TAG" --title "$TAG" --generate-notes | |
| fi | |
| gh release upload "$TAG" dist-tarball/*.tgz --clobber | |
| # Export the tag, sha256, and artifact URL so the Homebrew tap can | |
| # pin the exact tarball. The packed filename is dynamic | |
| # (anarchitecture-ghost-X.Y.Z.tgz), so resolve it from the staging dir. | |
| archive="$(ls dist-tarball/*.tgz | head -n 1)" | |
| filename="$(basename "$archive")" | |
| sha256="$(shasum -a 256 "$archive" | awk '{print $1}')" | |
| artifact_url="https://github.com/$GITHUB_REPOSITORY/releases/download/$TAG/$filename" | |
| { | |
| echo "tag=$TAG" | |
| echo "sha256=$sha256" | |
| echo "artifact_url=$artifact_url" | |
| } >> "$GITHUB_OUTPUT" | |
| # Mirror block/sessh: mint a scoped token for the OSS Homebrew tap and | |
| # trigger its bump-formula workflow so `brew install block/tap/ghost` | |
| # tracks releases automatically. block -> block, no Square refs. Gated on | |
| # an actual publish and on the BLOCK_HOMEBREW_TAP_* secrets (GitHub App | |
| # installed on this repo), so forks and unconfigured environments skip it | |
| # cleanly instead of failing the release. | |
| - name: Generate token for tap release | |
| id: generate_token | |
| if: ${{ steps.changesets.outputs.published == 'true' && env.HAS_TAP_APP == 'true' }} | |
| uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1 | |
| with: | |
| app-id: ${{ secrets.BLOCK_HOMEBREW_TAP_APP_ID }} | |
| private-key: ${{ secrets.BLOCK_HOMEBREW_TAP_PRIVATE_KEY }} | |
| owner: block | |
| repositories: homebrew-tap | |
| - name: Trigger Homebrew formula bump | |
| if: ${{ steps.changesets.outputs.published == 'true' && env.HAS_TAP_APP == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ steps.generate_token.outputs.token }} | |
| TAG: ${{ steps.tarball.outputs.tag }} | |
| ARTIFACT_URL: ${{ steps.tarball.outputs.artifact_url }} | |
| SHA256: ${{ steps.tarball.outputs.sha256 }} | |
| run: | | |
| gh workflow run bump-formula.yaml \ | |
| --repo block/homebrew-tap \ | |
| -f repo=block/ghost \ | |
| -f formula=ghost \ | |
| -f "tag=$TAG" \ | |
| -f "artifact_url=$ARTIFACT_URL" \ | |
| -f "sha256=$SHA256" |