Skip to content

Added npm publish workflow for both sdks #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DeveloperAmrit wants to merge 2 commits into
base: main
Choose a base branch
from
+218 −0
Open

Added npm publish workflow for both sdks #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5cd1f65
Added npm publish workflow
DeveloperAmrit Jan 24, 2026
2adf558
Fixed coderabbit major issues
DeveloperAmrit Feb 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file modified .DS_Store
View file
Open in desktop
Binary file not shown.
217 changes: 217 additions & 0 deletions .github/workflows/npm-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,217 @@
name: NPM Publish

on:
push:
branches:
- main
- master
paths:
- 'djed-sdk/package.json'
- 'stablepay-sdk/package.json'

jobs:
publish-djed-sdk:
runs-on: ubuntu-latest
timeout-minutes: 15
defaults:
run:
working-directory: ./djed-sdk
permissions:
contents: read
id-token: write
Comment on lines +19 to +21
Copy link

@coderabbitai coderabbitai bot Feb 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Drop unused id-token: write permission (least privilege).

id-token: write is not used by any step here (no OIDC/provenance flow), so this grants unnecessary privilege in both jobs.

🔧 Proposed fix 
     permissions:
       contents: read
-      id-token: write

Also applies to: 123-125

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/npm-publish.yml around lines 19 - 21, Remove the unused
id-token: write permission from the workflow permissions block(s); edit the
permissions mapping that currently contains "contents: read" and "id-token:
write" so it only includes required keys (e.g., remove the "id-token" entry),
and apply the same removal for the other permissions block referenced (the one
around lines 123-125) to enforce least privilege.

steps:
- uses: actions/checkout@v4

- uses: actions/setup-node@v4
with:
node-version: '18'
registry-url: 'https://registry.npmjs.org'

- name: Check version change
id: check
run: |
PACKAGE_NAME=$(node -p "require('./package.json').name")
LOCAL_VERSION=$(node -p "require('./package.json').version")

echo "Checking registry for $PACKAGE_NAME..."

# Retry loop for npm view to handle network flakes
PUBLISHED_VERSION=""
for i in {1..3}; do
if OUTPUT=$(npm view "$PACKAGE_NAME" version 2>/dev/null); then
PUBLISHED_VERSION=$OUTPUT
break
else
# Check if it's a 404 (package doesn't exist)
if npm view "$PACKAGE_NAME" version 2>&1 | grep -q "E404"; then
echo "Package not found on registry. Assuming new package."
PUBLISHED_VERSION="0.0.0"
break
fi

if [ $i -lt 3 ]; then
echo "Attempt $i failed. Retrying in 5 seconds..."
sleep 5
fi
fi
done

if [ -z "$PUBLISHED_VERSION" ]; then
echo "Failed to retrieve published version after 3 attempts. Assuming 0.0.0 to err on side of attempting publish."
PUBLISHED_VERSION="0.0.0"
fi

echo "Local version: $LOCAL_VERSION"
echo "Published version: $PUBLISHED_VERSION"

if [ "$LOCAL_VERSION" != "$PUBLISHED_VERSION" ]; then
echo "Version changed."
echo "changed=true" >> "$GITHUB_OUTPUT"
else
echo "Version unchanged."
echo "changed=false" >> "$GITHUB_OUTPUT"
fi
Comment on lines +67 to +73
Copy link

@coderabbitai coderabbitai bot Feb 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Publish gate should require a version increase, not just inequality.

On Line 67 and Line 169, != treats downgrades as “changed”, which can trigger failing publish attempts and violates the objective (“newer than published”).

🔧 Proposed fix 
-          if [ "$LOCAL_VERSION" != "$PUBLISHED_VERSION" ]; then
-            echo "Version changed."
+          if [ "$LOCAL_VERSION" != "$PUBLISHED_VERSION" ] && \
+             [ "$(printf '%s\n' "$PUBLISHED_VERSION" "$LOCAL_VERSION" | sort -V | tail -n1)" = "$LOCAL_VERSION" ]; then
+            echo "Version increased."
             echo "changed=true" >> "$GITHUB_OUTPUT"
           else
-            echo "Version unchanged."
+            echo "Version not increased."
             echo "changed=false" >> "$GITHUB_OUTPUT"
           fi

Apply the same update to both Check version change blocks.

Also applies to: 169-175

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/npm-publish.yml around lines 67 - 73, Replace the simple
inequality check ([ "$LOCAL_VERSION" != "$PUBLISHED_VERSION" ]) in both
version-check blocks with a semver-aware "is newer" test: use a sort -V
comparison such as checking that the last line of printf '%s\n'
"$PUBLISHED_VERSION" "$LOCAL_VERSION" | sort -V is equal to "$LOCAL_VERSION" and
also that the two versions are not equal; i.e. change the condition to something
like: if [ "$(printf '%s\n' "$PUBLISHED_VERSION" "$LOCAL_VERSION" | sort -V |
tail -n1)" = "$LOCAL_VERSION" ] && [ "$LOCAL_VERSION" != "$PUBLISHED_VERSION" ];
then ... and apply the same replacement for the second block (the other
occurrence of [ "$LOCAL_VERSION" != "$PUBLISHED_VERSION" ]).


- name: Install dependencies
if: steps.check.outputs.changed == 'true'
run: |
SUCCESS=false
for i in {1..3}; do
if npm ci; then
SUCCESS=true
break
else
echo "Install failed, retrying in 10 seconds..."
sleep 10
fi
done
if [ "$SUCCESS" != "true" ]; then
echo "Failed to install dependencies after 3 attempts"
exit 1
fi

- name: Build
if: steps.check.outputs.changed == 'true'
run: npm run build

- name: Publish to NPM
if: steps.check.outputs.changed == 'true'
run: |
SUCCESS=false
for i in {1..3}; do
if npm publish; then
SUCCESS=true
break
else
echo "Publish failed, retrying in 10 seconds..."
sleep 10
fi
done
if [ "$SUCCESS" != "true" ]; then
echo "Failed to publish after 3 attempts"
exit 1
fi
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

publish-stablepay-sdk:
runs-on: ubuntu-latest
timeout-minutes: 15
defaults:
run:
working-directory: ./stablepay-sdk
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@v4

- uses: actions/setup-node@v4
with:
node-version: '18'
registry-url: 'https://registry.npmjs.org'

- name: Check version change
id: check
run: |
PACKAGE_NAME=$(node -p "require('./package.json').name")
LOCAL_VERSION=$(node -p "require('./package.json').version")

echo "Checking registry for $PACKAGE_NAME..."

PUBLISHED_VERSION=""
for i in {1..3}; do
if OUTPUT=$(npm view "$PACKAGE_NAME" version 2>/dev/null); then
PUBLISHED_VERSION=$OUTPUT
break
else
if npm view "$PACKAGE_NAME" version 2>&1 | grep -q "E404"; then
echo "Package not found on registry. Assuming new package."
PUBLISHED_VERSION="0.0.0"
break
fi

if [ $i -lt 3 ]; then
echo "Attempt $i failed. Retrying in 5 seconds..."
sleep 5
fi
fi
done

if [ -z "$PUBLISHED_VERSION" ]; then
echo "Failed to retrieve published version after 3 attempts. Assuming 0.0.0 to err on side of attempting publish."
PUBLISHED_VERSION="0.0.0"
fi

echo "Local version: $LOCAL_VERSION"
echo "Published version: $PUBLISHED_VERSION"

if [ "$LOCAL_VERSION" != "$PUBLISHED_VERSION" ]; then
echo "Version changed."
echo "changed=true" >> "$GITHUB_OUTPUT"
else
echo "Version unchanged."
echo "changed=false" >> "$GITHUB_OUTPUT"
fi

- name: Install dependencies
if: steps.check.outputs.changed == 'true'
run: |
SUCCESS=false
for i in {1..3}; do
if npm ci; then
SUCCESS=true
break
else
echo "Install failed, retrying in 10 seconds..."
sleep 10
fi
done
if [ "$SUCCESS" != "true" ]; then
echo "Failed to install dependencies after 3 attempts"
exit 1
fi

- name: Build
if: steps.check.outputs.changed == 'true'
run: npm run build

- name: Publish to NPM
if: steps.check.outputs.changed == 'true'
run: |
SUCCESS=false
for i in {1..3}; do
if npm publish; then
SUCCESS=true
break
else
echo "Publish failed, retrying in 10 seconds..."
sleep 10
fi
done
if [ "$SUCCESS" != "true" ]; then
echo "Failed to publish after 3 attempts"
exit 1
fi
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
1 change: 1 addition & 0 deletions djed-sdk/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
"main": "dist/umd/index.js",
"module": "dist/esm/index.js",
"scripts": {
"build": "rollup -c",
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
Expand Down