1- # This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
1+ # This workflow automatically versions, builds, tests, and publishes Nx monorepo packages to npm
2+ # It uses OIDC trusted publishing for enhanced security
23# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
34
45name : " @adenta-npm-publish"
78 push :
89 branches :
910 - main # Triggers when code is pushed to main branch
10- tags :
11- - ' v*.*.*' # Triggers when version tags are pushed
12- release :
13- types : [created] # Triggers when a new release is created
1411
1512jobs :
1613 build :
1714 runs-on : ubuntu-latest
1815 permissions :
19- contents : write # for tagging
20- id-token : write # needed for provenance data generation
16+ id-token : write # Required for OIDC trusted publishing
17+ contents : read
2118 steps :
2219 - name : Checkout Repository
2320 uses : actions/checkout@v4
21+ with :
22+ fetch-depth : 0 # Required for git history
2423
2524 - name : Install pnpm
2625 uses : pnpm/action-setup@v2
@@ -34,42 +33,164 @@ jobs:
3433 cache : " pnpm"
3534 registry-url : https://registry.npmjs.org/
3635
36+ - name : Restore dependencies
37+ uses : actions/cache@v3
38+ with :
39+ path : |
40+ node_modules
41+ packages/*/node_modules
42+ key : ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
3743
3844 - name : Install dependencies
39- run : pnpm install
45+ run : pnpm install --frozen-lockfile
4046 shell : bash
4147
4248 - name : Print Environment Info
4349 run : pnpm exec nx report
4450 shell : bash
4551
52+ - name : Build packages
53+ run : pnpm exec nx run-many --target=build --all
54+ shell : bash
55+
56+ test :
57+ runs-on : ubuntu-latest
58+ permissions :
59+ id-token : write # Required for OIDC trusted publishing
60+ contents : read
61+ steps :
62+ - name : Checkout Repository
63+ uses : actions/checkout@v4
64+ with :
65+ fetch-depth : 0 # Required for git history
66+
67+ - name : Install pnpm
68+ uses : pnpm/action-setup@v2
69+ with :
70+ version : 10
71+
72+ - name : Setup Node
73+ uses : actions/setup-node@v4
74+ with :
75+ node-version : 20
76+ cache : " pnpm"
77+ registry-url : https://registry.npmjs.org/
78+
79+ - name : Restore dependencies
80+ uses : actions/cache@v3
81+ with :
82+ path : |
83+ node_modules
84+ packages/*/node_modules
85+ key : ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
86+
87+ - name : Install dependencies
88+ run : pnpm install --frozen-lockfile
89+ shell : bash
90+
4691 - name : Run Tests
47- run : echo "Test Here"
92+ run : pnpm exec nx run-many --target=test --all
4893 shell : bash
49-
50- # Todo make this step automated
51- # - name: Version and Changelog
52- # run: pnpm exec nx release --skip-publish --specifier prerelease --first-release
53- # shell: bash
5494
55- - name : Publish packages
56- run : pnpm exec nx release publish --verbose
95+ version :
96+ runs-on : ubuntu-latest
97+ permissions :
98+ id-token : write # Required for OIDC trusted publishing
99+ contents : write # Required for committing version changes
100+ steps :
101+ - name : Checkout Repository
102+ uses : actions/checkout@v4
103+ with :
104+ fetch-depth : 0 # Required for git history
105+ token : ${{ secrets.GITHUB_TOKEN }}
106+
107+ - name : Install pnpm
108+ uses : pnpm/action-setup@v2
109+ with :
110+ version : 10
111+
112+ - name : Setup Node
113+ uses : actions/setup-node@v4
114+ with :
115+ node-version : 20
116+ cache : " pnpm"
117+ registry-url : https://registry.npmjs.org/
118+
119+ - name : Restore dependencies
120+ uses : actions/cache@v3
121+ with :
122+ path : |
123+ node_modules
124+ packages/*/node_modules
125+ key : ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
126+
127+ - name : Install dependencies
128+ run : pnpm install --frozen-lockfile
129+ shell : bash
130+
131+ - name : Configure Git
132+ run : |
133+ git config user.name "github-actions[bot]"
134+ git config user.email "github-actions[bot]@users.noreply.github.com"
135+ shell : bash
136+
137+ - name : Generate Version and Changelog
138+ run : pnpm exec nx release version --skip-publish
57139 shell : bash
58140 env :
59- NODE_AUTH_TOKEN : ${{ secrets.NPM_TOKEN }}
60- NPM_CONFIG_PROVENANCE : true
61-
62- # publish-npm:
63- # needs: build
64- # runs-on: ubuntu-latest
65- # steps:
66- # - uses: actions/checkout@v4
67- # - uses: actions/setup-node@v4
68- # with:
69- # node-version: ${{ matrix.node-version }}
70- # registry-url: https://registry.npmjs.org/
141+ GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
142+
143+ - name : Commit Version Changes
144+ run : |
145+ git add .
146+ git diff --staged --quiet || git commit -m "chore(release): update version and changelog"
147+ git push origin main --follow-tags
148+ shell : bash
149+
150+ publish :
151+ needs : [build, test, version]
152+ runs-on : ubuntu-latest
153+ permissions :
154+ id-token : write # Required for OIDC trusted publishing
155+ contents : write # for tagging and releases
156+ steps :
157+ - name : Checkout Repository
158+ uses : actions/checkout@v4
159+ with :
160+ fetch-depth : 0 # Required for git history
161+
162+ - name : Install pnpm
163+ uses : pnpm/action-setup@v2
164+ with :
165+ version : 10
71166
72- # - name: Install pnpm
73- # uses: pnpm/action-setup@v2
74- # with:
75- # version: 10
167+ - name : Setup Node
168+ uses : actions/setup-node@v4
169+ with :
170+ node-version : 20
171+ cache : " pnpm"
172+ registry-url : https://registry.npmjs.org/
173+
174+ - name : Restore dependencies
175+ uses : actions/cache@v3
176+ with :
177+ path : |
178+ node_modules
179+ packages/*/node_modules
180+ key : ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
181+
182+ - name : Install dependencies
183+ run : pnpm install --frozen-lockfile
184+ shell : bash
185+
186+ - name : Ensure npm 11.5.1 or later for trusted publishing
187+ run : npm install -g npm@latest
188+ shell : bash
189+
190+ - name : Publish packages with Nx Release
191+ run : pnpm exec nx release publish --verbose
192+ shell : bash
193+ env :
194+ # No NODE_AUTH_TOKEN needed with trusted publishing!
195+ # OIDC token is automatically generated and used
196+ NPM_CONFIG_PROVENANCE : true
0 commit comments