chore(main): release 0.1.4 (#9) #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| # Maintains a rolling release PR from conventional commits on main. Merging that PR | |
| # bumps package.json, writes CHANGELOG.md, tags, and publishes a GitHub Release — | |
| # which is what flips release_created to true on the following run. | |
| release-please: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| release_created: ${{ steps.release.outputs.release_created }} | |
| tag_name: ${{ steps.release.outputs.tag_name }} | |
| steps: | |
| - uses: googleapis/release-please-action@v5 | |
| id: release | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| # Publish only when release-please actually cut a release. Authentication is npm Trusted | |
| # Publishing (OIDC) — this repo and this workflow file are registered as a trusted | |
| # publisher for the package on npmjs.com, so there is no stored credential to rotate. | |
| # Without that registration this job fails loudly rather than skipping, so a release never | |
| # looks published when it isn't. | |
| publish: | |
| needs: release-please | |
| if: ${{ needs.release-please.outputs.release_created == 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write # required for OIDC auth and provenance | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 24 | |
| registry-url: https://registry.npmjs.org | |
| # Trusted Publishing needs npm >= 11.5.1. Node 24 already ships npm 11.x, but pinning | |
| # the upgrade explicitly means a future runner image change can't silently drop us | |
| # back to token auth — which would fail confusingly rather than obviously. | |
| - name: Ensure npm supports trusted publishing | |
| run: | | |
| npm install -g npm@latest | |
| npm --version | |
| # The same gate CI runs on every PR. prepublishOnly would catch this too; running it | |
| # explicitly means a failure reads as "the library is invalid", not "publish broke". | |
| - name: Validate skills | |
| run: npm run validate | |
| # No NODE_AUTH_TOKEN: with Trusted Publishing, npm authenticates via OIDC and | |
| # generates provenance automatically. If we ever fall back to a token, add | |
| # `env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` here. | |
| - name: Publish to npm | |
| run: npm publish --access public | |
| - name: Summarize | |
| run: echo "Published ${{ needs.release-please.outputs.tag_name }} to npm" >> "$GITHUB_STEP_SUMMARY" |