publish-packages.yml

name: Publish Packages

# This workflow publishes packages to npm when changes are merged to main branch or when manually triggered.

on:
  push:
    paths:
      - 'packages/**'
    # For security reasons, this should never be set to anything but `main`
    branches: [main]
  workflow_dispatch:
    inputs:
      package:
        description: 'Specific package to publish (leave empty for all packages)'
        required: false
        type: string

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

env:
  COMMIT_SHA: ${{ github.sha }}

jobs:
  prepare-packages:
    name: Prepare Packages
    runs-on: ubuntu-latest
    outputs:
      # Output the matrix of packages to publish for use in the publish job
      matrix: ${{ steps.generate-matrix.outputs.matrix }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Verify commit authenticity
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Get commit data from GitHub API to verify its authenticity
          COMMIT_DATA=$(gh api repos/${{ github.repository }}/commits/$COMMIT_SHA)
          # Check if commit signature is verified (GPG signed)
          VERIFIED=$(echo "$COMMIT_DATA" | jq -r '.commit.verification.verified')
          # Check if commit was made through GitHub's web interface (merge queue)
          COMMITTER=$(echo "$COMMIT_DATA" | jq -r '.commit.committer.email')

          # Security checks to ensure we only publish from verified and trusted sources
          if [[ "$VERIFIED" != "true" ]]; then
            echo "❌ Unverified commit! Aborting."
            exit 1
          fi

          if [[ "$COMMITTER" != "noreply@github.com" ]]; then
            echo "❌ Not merged with the merge queue! Aborting."
            exit 1
          fi

          echo "✅ Commit is verified and trusted."

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 2 # Need at least 2 commits to detect changes between commits
          persist-credentials: false

      - name: Generate package matrix
        id: generate-matrix
        env:
          PACKAGE: ${{ github.event.inputs.package }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [ -n "$PACKAGE" ]; then
            # If a specific package is requested via workflow_dispatch, just publish that one
            echo "matrix={\"package\":[\"$PACKAGE\"]}" >> $GITHUB_OUTPUT
          else
            CHANGED_PACKAGES=()
            for pkg in $(ls -d packages/*); do
              PKG_NAME=$(basename "$pkg")
              PKG_JSON="$pkg/package.json"

              # Determine if the package has changed (or include all on manual trigger)
              if [ "$EVENT_NAME" == "workflow_dispatch" ] || ! git diff --quiet $COMMIT_SHA~1 $COMMIT_SHA -- "$pkg/"; then
                OLD_VERSION=$(git show $COMMIT_SHA~1:$PKG_JSON | jq -r '.version')
                NEW_VERSION=$(jq -r '.version' "$PKG_JSON")
                if [ "$OLD_VERSION" != "$NEW_VERSION" ]; then
                  CHANGED_PACKAGES+=("$PKG_NAME")
                fi
              fi
            done

            # Format the output for GitHub Actions matrix using jq
            PACKAGES_JSON=$(jq -n '$ARGS.positional' --args "${CHANGED_PACKAGES[@]}" -c)
            echo "matrix={\"package\":$PACKAGES_JSON}" >> $GITHUB_OUTPUT
          fi

  publish:
    name: Publish
    needs: prepare-packages
    runs-on: ubuntu-latest
    permissions:
      # Required for npm OIDC publishing (https://docs.npmjs.com/trusted-publishers)
      id-token: write
    # Skip if no packages need to be published
    if: fromJson(needs.prepare-packages.outputs.matrix).package[0] != null
    # Use the dynamic matrix from prepare-packages job to create parallel jobs for each package
    strategy:
      matrix: ${{ fromJson(needs.prepare-packages.outputs.matrix) }}
      fail-fast: false # Continue publishing other packages even if one fails
    steps:
      - uses: nodejs/web-team/actions/setup-environment@9f3c83af227d721768d9dbb63009a47ed4f4282f
        with:
          pnpm: true
          use-version-file: true
          registry-url: 'https://registry.npmjs.org'

      - name: Publish
        working-directory: packages/${{ matrix.package }}
        run: |
          # Check if a custom publish script exists in package.json
          if jq -e '.scripts.release' package.json > /dev/null; then
            pnpm run release
          fi

          # Then publish the package to npm
          pnpm publish --access public --no-git-checks

      - name: Notify on Manual Release
        if: ${{ github.event_name == 'workflow_dispatch' }}
        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # 2.3.3
        env:
          SLACK_COLOR: '#43853D'
          SLACK_ICON: https://github.com/nodejs.png?size=48
          SLACK_TITLE: ':rocket: Package Published: ${{ matrix.package }}'
          SLACK_MESSAGE: |
            :package: *Package*: `${{ matrix.package }}` (<https://www.npmjs.com/package/@node-core/${{ matrix.package }}|View on npm>)
            :bust_in_silhouette: *Published by*: ${{ github.triggering_actor }}
            :octocat: *Commit*: <https://github.com/${{ github.repository }}/commit/${{ env.COMMIT_SHA }}|${{ env.COMMIT_SHA }}>
          SLACK_USERNAME: nodejs-bot
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}