Skip to content

chore: update publish workflow #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ghostdevv wants to merge 7 commits into
base: main
Choose a base branch
from
Open

chore: update publish workflow #41

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6777952
chore: use hashes for versions
ghostdevv May 23, 2026
f71fb9c
chore: don't save git credentials
ghostdevv May 23, 2026
e02b53d
chore: limit id-token permission to the publishing steps
ghostdevv May 23, 2026
3d20c30
chore: explicitly disable npm cache to mitigate cache poisoning attacks
ghostdevv May 23, 2026
ef025a7
chore: mitigate potential template injection
ghostdevv May 23, 2026
3f197de
chore: use oidc
ghostdevv May 23, 2026
cad9f73
chore: update ::set-output command to new syntax
ghostdevv May 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 36 additions & 18 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,19 +7,19 @@ on:

permissions:
contents: read
id-token: write

jobs:
verify-jsr:
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
submodules: true
persist-credentials: false

- name: setup deno
uses: denoland/setup-deno@v2
uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
with:
deno-version: v2.x

Expand All @@ -28,10 +28,12 @@ jobs:

- name: Get Version
id: vars
run: echo ::set-output name=version::$(echo ${{github.ref_name}} | sed 's/^v//')
run: echo "version=$(echo ${GITHUB_REF_NAME} | sed 's/^v//')" >> $GITHUB_OUTPUT

- name: Build JSR
run: deno task build:jsr ${{steps.vars.outputs.version}}
run: deno task build:jsr ${STEPS_VARS_OUTPUTS_VERSION}
env:
STEPS_VARS_OUTPUTS_VERSION: ${{steps.vars.outputs.version}}

- name: dry run publish
run: deno publish --dry-run --allow-dirty
Expand All @@ -40,12 +42,13 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
submodules: true
persist-credentials: false

- name: setup deno
uses: denoland/setup-deno@v2
uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
with:
deno-version: v2.x

Expand All @@ -54,38 +57,47 @@ jobs:

- name: Get Version
id: vars
run: echo ::set-output name=version::$(echo ${{github.ref_name}} | sed 's/^v//')
run: echo "version=$(echo ${GITHUB_REF_NAME} | sed 's/^v//')" >> $GITHUB_OUTPUT

- name: Setup Node
uses: actions/setup-node@v6
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 24
package-manager-cache: false
cache: ''

- name: Build NPM
run: deno task build:npm ${{steps.vars.outputs.version}}
run: deno task build:npm ${STEPS_VARS_OUTPUTS_VERSION}
env:
STEPS_VARS_OUTPUTS_VERSION: ${{steps.vars.outputs.version}}

- name: dry run publish
run: npm publish --dry-run --tag=verify
working-directory: ./build/npm

- name: upload build
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: npm-build
path: ./build/npm

publish-npm:
needs: [verify-jsr, verify-npm]
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write

steps:
- name: Setup Node
uses: actions/setup-node@v6
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 24
package-manager-cache: false
cache: ''

- name: download build
uses: actions/download-artifact@v4
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: npm-build
path: ./build/npm
Expand All @@ -97,15 +109,19 @@ jobs:
publish-jsr:
needs: [verify-jsr, verify-npm]
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write

steps:
- name: checkout
uses: actions/checkout@v4
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
submodules: true
persist-credentials: false

- name: setup deno
uses: denoland/setup-deno@v2
uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
with:
deno-version: v2.x

Expand All @@ -114,10 +130,12 @@ jobs:

- name: Get Version
id: vars
run: echo ::set-output name=version::$(echo ${{github.ref_name}} | sed 's/^v//')
run: echo "version=$(echo ${GITHUB_REF_NAME} | sed 's/^v//')" >> $GITHUB_OUTPUT

- name: Build JSR
run: deno task build:jsr ${{steps.vars.outputs.version}}
run: deno task build:jsr ${STEPS_VARS_OUTPUTS_VERSION}
env:
STEPS_VARS_OUTPUTS_VERSION: ${{steps.vars.outputs.version}}

- name: Publish JSR
run: deno publish --allow-dirty --token=${{ secrets.JSR_TOKEN }}
run: deno publish --allow-dirty