public-repo

Artifact Publishing

This repository includes an automated artifact publishing mechanism that:

1. Builds artifacts in GitHub Actions with optimized caching
2. Publishes artifacts to GitHub Releases when a tag is pushed
3. Publishes packages to GitHub Packages
4. Publishes container images to GitHub Container Registry
5. Generates SHA256 checksums for all artifacts

How to Publish

Automatic Publishing

To automatically publish a new release:

1. Create and push a new tag with the version number:

   git tag v1.0.1
   git push origin v1.0.1

2. The CI/CD pipeline will automatically:

   • Build the project
   • Generate SHA256 checksums for artifacts
   • Create a GitHub Release with the artifacts and checksums
   • Publish the package to GitHub Packages
   • Publish container images to GitHub Container Registry

Manual Publishing

You can also manually trigger the publishing workflow:

1. Go to the Actions tab in the GitHub repository
2. Select the "CI/CD Pipeline - Test, Build and Publish" workflow
3. Click "Run workflow"
4. Choose to publish to GitHub Packages and/or Container Registry
5. Click "Run workflow"

Required Secrets

No additional secrets are required for GitHub Packages or Container Registry publishing as they use the automatically provided GITHUB_TOKEN.

Accessing Published Artifacts

GitHub Packages (npm package)

To install the package from GitHub Packages:

1. Create or update your .npmrc file:

   @OWNER:registry=https://npm.pkg.github.com
   //npm.pkg.github.com/:_authToken=YOUR_GITHUB_TOKEN
   

2. Install the package:

   npm install @OWNER/public-repo

Replace OWNER with the GitHub username or organization name, and YOUR_GITHUB_TOKEN with a personal access token that has read:packages scope.

GitHub Releases (zip archive)

To download the release archive:

1. Go to the repository's Releases page
2. Find the desired release version
3. Download the public-repo-VERSION.zip file

GitHub Container Registry

To pull the container image:

docker pull ghcr.io/OWNER/public-repo:latest
# or a specific version
docker pull ghcr.io/OWNER/public-repo:1.0.1

Replace OWNER with the GitHub username or organization name.

Artifact Verification

All published artifacts include SHA256 checksums for verification.

Verifying Checksums

A verification script is provided to simplify the process:

./scripts/verify-checksum.sh OWNER VERSION

For example:

./scripts/verify-checksum.sh myusername 1.0.1

Or manually verify:

# Download the artifact and checksum
curl -LO https://github.com/OWNER/public-repo/releases/download/vVERSION/public-repo-VERSION.zip
curl -LO https://github.com/OWNER/public-repo/releases/download/vVERSION/public-repo-VERSION.zip.sha256

# Verify the checksum
echo "$(cat public-repo-VERSION.zip.sha256) public-repo-VERSION.zip" | sha256sum --check

Replace OWNER with the GitHub username or organization name and VERSION with the release version.