refactor: use npm provenance (OIDC) for tokenless publishing #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| env: | |
| CARGO_TERM_COLOR: always | |
| permissions: | |
| contents: write | |
| id-token: write | |
| jobs: | |
| publish-crates: | |
| name: Publish Rust crates | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Publish srcmap-codec | |
| run: cargo publish -p srcmap-codec || echo "Already published, skipping" | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} | |
| - name: Wait for crates.io index | |
| run: sleep 30 | |
| - name: Publish srcmap-sourcemap | |
| run: cargo publish -p srcmap-sourcemap || echo "Already published, skipping" | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} | |
| - name: Publish srcmap-generator | |
| run: cargo publish -p srcmap-generator || echo "Already published, skipping" | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} | |
| - name: Wait for crates.io index | |
| run: sleep 30 | |
| - name: Publish srcmap-remapping | |
| run: cargo publish -p srcmap-remapping || echo "Already published, skipping" | |
| env: | |
| CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} | |
| build-napi: | |
| name: Build NAPI - ${{ matrix.settings.target }} | |
| runs-on: ${{ matrix.settings.host }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| settings: | |
| - host: macos-latest | |
| target: x86_64-apple-darwin | |
| - host: macos-latest | |
| target: aarch64-apple-darwin | |
| - host: ubuntu-latest | |
| target: x86_64-unknown-linux-gnu | |
| - host: ubuntu-latest | |
| target: x86_64-unknown-linux-musl | |
| - host: ubuntu-latest | |
| target: aarch64-unknown-linux-gnu | |
| linker: aarch64-linux-gnu-gcc | |
| - host: ubuntu-latest | |
| target: aarch64-unknown-linux-musl | |
| linker: aarch64-linux-gnu-gcc | |
| - host: windows-latest | |
| target: x86_64-pc-windows-msvc | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.settings.target }} | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Install musl tools | |
| if: contains(matrix.settings.target, 'musl') | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y musl-tools | |
| - name: Install aarch64 cross-compilation tools | |
| if: matrix.settings.target == 'aarch64-unknown-linux-gnu' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu | |
| - name: Install aarch64 musl cross-compilation tools | |
| if: matrix.settings.target == 'aarch64-unknown-linux-musl' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu musl-tools | |
| - name: Install @napi-rs/cli | |
| run: npm install -g @napi-rs/cli | |
| - name: Build codec NAPI binary | |
| run: | | |
| cd packages/codec | |
| napi build --release --platform --target ${{ matrix.settings.target }} | |
| shell: bash | |
| env: | |
| CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: ${{ matrix.settings.linker || '' }} | |
| CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: ${{ matrix.settings.linker || '' }} | |
| - name: Build sourcemap NAPI binary | |
| run: | | |
| cd packages/sourcemap | |
| napi build --release --platform --target ${{ matrix.settings.target }} | |
| shell: bash | |
| env: | |
| CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: ${{ matrix.settings.linker || '' }} | |
| CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER: ${{ matrix.settings.linker || '' }} | |
| - name: Upload codec artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: codec-bindings-${{ matrix.settings.target }} | |
| path: packages/codec/*.node | |
| if-no-files-found: error | |
| - name: Upload sourcemap artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sourcemap-bindings-${{ matrix.settings.target }} | |
| path: packages/sourcemap/*.node | |
| if-no-files-found: error | |
| build-wasm: | |
| name: Build WASM | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-unknown-unknown | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Install wasm-pack | |
| run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh | |
| - name: Build WASM package | |
| run: wasm-pack build --target nodejs --release | |
| working-directory: packages/sourcemap-wasm | |
| - name: Upload WASM artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: wasm-package | |
| path: packages/sourcemap-wasm/pkg/ | |
| if-no-files-found: error | |
| publish-npm: | |
| name: Publish npm packages | |
| runs-on: ubuntu-latest | |
| needs: [build-napi, build-wasm] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| registry-url: https://registry.npmjs.org | |
| - name: Install @napi-rs/cli | |
| run: npm install -g @napi-rs/cli | |
| - name: Download all codec NAPI artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: packages/codec/artifacts | |
| pattern: codec-bindings-* | |
| merge-multiple: false | |
| - name: Download all sourcemap NAPI artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: packages/sourcemap/artifacts | |
| pattern: sourcemap-bindings-* | |
| merge-multiple: false | |
| - name: Download WASM artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: wasm-package | |
| path: packages/sourcemap-wasm/pkg | |
| - name: Move codec artifacts | |
| run: napi artifacts -d artifacts | |
| working-directory: packages/codec | |
| - name: Move sourcemap artifacts | |
| run: napi artifacts -d artifacts | |
| working-directory: packages/sourcemap | |
| - name: Publish @srcmap/codec platform packages | |
| run: | | |
| for dir in npm/*/; do | |
| npm publish "$dir" --access public --provenance || echo "Skipping $(basename "$dir")" | |
| done | |
| working-directory: packages/codec | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Publish @srcmap/codec | |
| run: npm publish --access public --provenance --ignore-scripts | |
| working-directory: packages/codec | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Publish @srcmap/sourcemap platform packages | |
| run: | | |
| for dir in npm/*/; do | |
| npm publish "$dir" --access public --provenance || echo "Skipping $(basename "$dir")" | |
| done | |
| working-directory: packages/sourcemap | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Publish @srcmap/sourcemap | |
| run: npm publish --access public --provenance --ignore-scripts | |
| working-directory: packages/sourcemap | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Publish @srcmap/sourcemap-wasm | |
| run: npm publish --access public --provenance --ignore-scripts | |
| working-directory: packages/sourcemap-wasm | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| create-release: | |
| name: Create GitHub Release | |
| runs-on: ubuntu-latest | |
| needs: [publish-crates, publish-npm] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| generate_release_notes: true |