diff --git a/.github.jsonnet b/.github.jsonnet index d07e5dc9..a9d8f9a2 100644 --- a/.github.jsonnet +++ b/.github.jsonnet @@ -1,7 +1,7 @@ local util = import '.github/jsonnet/index.jsonnet'; util.workflowJavascriptPackage( - repositories=['github', 'gynzy'], + repositories=['github'], packageManager='pnpm', branch='main', isPublicFork=true, diff --git a/.github/jsonnet/GIT_VERSION b/.github/jsonnet/GIT_VERSION index f8447221..6ee27ed3 100644 --- a/.github/jsonnet/GIT_VERSION +++ b/.github/jsonnet/GIT_VERSION @@ -1 +1 @@ -48fa11c3a7d9df1e16a1cf7e86505945b0b7b6a2 +545ab086d65446b210d470713a69ba3beecf28e9 diff --git a/.github/jsonnet/complete-workflows.jsonnet b/.github/jsonnet/complete-workflows.jsonnet index 17fbf495..d930df02 100644 --- a/.github/jsonnet/complete-workflows.jsonnet +++ b/.github/jsonnet/complete-workflows.jsonnet @@ -12,18 +12,18 @@ local yarn = import 'yarn.jsonnet'; * 2. 'publish-prod' - Production package publishing on branch push * 3. 'pr' - Pull request preview publishing and testing * - * @param {array} [repositories=['gynzy']] - The repositories to publish to + * @param {array} [repositories=['github']] - The repositories to publish to * @param {boolean} [isPublicFork=true] - Whether the repository is a public fork (affects runner selection) * @param {boolean} [checkVersionBump=true] - Whether to assert if the version was bumped (recommended) * @param {jobs} [testJob=null] - A job to be run during PR to assert tests. Can be an array of jobs - * @param {string} [branch='main'] - The branch to run the publish-prod job on + * @param {string} [branch='main'] - The branch that triggers the publish-prod job; publishes the package specified in package.json and sets latest tag * @param {string} [packageManager='yarn'] - Package manager to use ('yarn' or 'pnpm') * @param {string} [image=null] - Docker image override for publish jobs; null uses the PM-specific default * @param {array} [buildSteps=null] - Build steps override; null uses the PM-specific default. Pass `[]` to skip build. * @returns {workflows} - Complete set of GitHub Actions workflows for JavaScript package lifecycle */ workflowJavascriptPackage( - repositories=['gynzy'], + repositories=['github'], isPublicFork=true, checkVersionBump=true, testJob=null, @@ -37,8 +37,8 @@ local yarn = import 'yarn.jsonnet'; else [base.step('build', 'yarn build')]; local effectiveBuildSteps = if buildSteps != null then buildSteps else defaultBuildSteps; local publishJob = if packageManager == 'pnpm' - then pnpm.pnpmPublishJob(repositories=repositories, runsOn=runsOn, image=image, buildSteps=effectiveBuildSteps) - else yarn.yarnPublishJob(repositories=repositories, runsOn=runsOn, image=image, buildSteps=effectiveBuildSteps); + then pnpm.pnpmPublishJob(repositories=repositories, runsOn=runsOn, image=image, buildSteps=effectiveBuildSteps, publishBranch=branch) + else yarn.yarnPublishJob(repositories=repositories, runsOn=runsOn, image=image, buildSteps=effectiveBuildSteps, publishBranch=branch); local previewJob = if packageManager == 'pnpm' then pnpm.pnpmPublishPreviewJob(repositories=repositories, runsOn=runsOn, checkVersionBump=checkVersionBump, image=image, buildSteps=effectiveBuildSteps) else yarn.yarnPublishPreviewJob(repositories=repositories, runsOn=runsOn, checkVersionBump=checkVersionBump, image=image, buildSteps=effectiveBuildSteps); diff --git a/.github/jsonnet/newrelic.jsonnet b/.github/jsonnet/newrelic.jsonnet index 660296f8..cb8d9344 100644 --- a/.github/jsonnet/newrelic.jsonnet +++ b/.github/jsonnet/newrelic.jsonnet @@ -10,7 +10,7 @@ local pnpm = import 'pnpm.jsonnet'; * * @param {array} apps - Array of application objects containing deployment information * @param {string} [cacheName=null] - Name of the cache to use for yarn/pnpm dependencies - * @param {string} [source='gynzy'] - Registry source ('gynzy' or 'github') for npm packages + * @param {string} [source='github'] - Registry source ('gynzy' or 'github') for npm packages * @param {string} [image='mirror.gcr.io/node:20.17'] - Docker image to use for the job * @param {boolean} [useCredentials=false] - Whether to use Docker registry credentials * @param {string} [packageManager='yarn'] - Package manager to use ('yarn' or 'pnpm') @@ -20,7 +20,7 @@ local pnpm = import 'pnpm.jsonnet'; postReleaseToNewRelicJob( apps, cacheName=null, - source='gynzy', + source='github', image='mirror.gcr.io/node:20.17', useCredentials=false, packageManager='yarn', diff --git a/.github/jsonnet/pnpm.jsonnet b/.github/jsonnet/pnpm.jsonnet index b2976f1e..bd59adc0 100644 --- a/.github/jsonnet/pnpm.jsonnet +++ b/.github/jsonnet/pnpm.jsonnet @@ -62,7 +62,7 @@ local yarn = import 'yarn.jsonnet'; * @param {string} [ref=null] - Git ref to checkout (branch, tag, or commit) * @param {boolean} [prod=false] - Whether to install only production dependencies * @param {string} [workingDirectory=null] - Directory to run operations in - * @param {string} [source='gynzy'] - Registry source ('gynzy' or 'github') + * @param {string} [source='github'] - Registry source ('gynzy' or 'github') * @param {array} [pnpmInstallArgs=[]] - Additional arguments for pnpm install command * @param {boolean} [setupPnpm=true] - Whether to set up and install pnpm itself before installing all packages * @param {boolean} [blobless=null] - Whether to perform a blobless clone (--filter=blob:none); null uses checkout default @@ -77,7 +77,7 @@ local yarn = import 'yarn.jsonnet'; ref=null, prod=false, workingDirectory=null, - source='gynzy', + source='github', pnpmInstallArgs=[], setupPnpm=true, blobless=null, @@ -182,12 +182,13 @@ local yarn = import 'yarn.jsonnet'; * @param {array} [pnpmInstallArgs=[]] - Additional arguments for pnpm install * @param {string} [auditLevel='moderate'] - Minimum severity level to fail the job ('low', 'moderate', 'high', 'critical') * @param {string} [runsOn=null] - GitHub Actions runner to use for the job + * @param {string} [source='github'] - Where to install @gynzy packages from ('github', 'gynzy') * @param {boolean} [blobless=null] - Whether to perform a blobless clone (--filter=blob:none); null uses checkout default * @param {number} [retryAttempts=null] - Number of additional checkout attempts on failure; null uses checkout default * @param {number} [cloneTimeout=null] - Timeout for git clone operation in minutes; null uses checkout default * @returns {workflows} - Complete GitHub Actions pipeline configuration */ - pnpmAuditPipeline(cacheName=null, image=null, setupPnpm=true, pnpmInstallArgs=[], auditLevel='moderate', runsOn=null, blobless=null, retryAttempts=null, cloneTimeout=null):: + pnpmAuditPipeline(cacheName=null, image=null, setupPnpm=true, pnpmInstallArgs=[], auditLevel='moderate', runsOn=null, source=null, blobless=null, retryAttempts=null, cloneTimeout=null):: base.pipeline( 'pnpm-audit', [ @@ -201,6 +202,7 @@ local yarn = import 'yarn.jsonnet'; ref='${{ github.event.pull_request.head.sha }}', setupPnpm=setupPnpm, pnpmInstallArgs=pnpmInstallArgs, + source=source, blobless=blobless, retryAttempts=retryAttempts, cloneTimeout=cloneTimeout, @@ -217,9 +219,15 @@ local yarn = import 'yarn.jsonnet'; * * @param {boolean} [isPr=true] - Whether this is a PR build (affects versioning) * @param {string} [ifClause=null] - Conditional expression to determine if step should run + * @param {string} [publishBranch=null] - The branch that triggers the publish-prod job; publishes the package specified in package.json and sets latest tag. When null, defaults to `main`/`master` * @returns {steps} - Array containing a single step object */ - pnpmPublish(isPr=true, ifClause=null):: + pnpmPublish(isPr=true, ifClause=null, publishBranch=null):: + local branchCheck = + if publishBranch == null then + '( "${GITHUB_REF_NAME}" == "main" || "${GITHUB_REF_NAME}" == "master" )' + else + '"${GITHUB_REF_NAME}" == "' + publishBranch + '"'; base.step( 'publish', ||| @@ -240,7 +248,7 @@ local yarn = import 'yarn.jsonnet'; echo "Setting tag/version for release/tag build."; PUBLISHVERSION=$VERSION; TAG="latest"; - elif [[ "${GITHUB_REF_TYPE}" == "branch" && ( "${GITHUB_REF_NAME}" == "main" || "${GITHUB_REF_NAME}" == "master" ) ]] || [[ "${GITHUB_EVENT_NAME}" == "deployment" ]]; then + elif [[ "${GITHUB_REF_TYPE}" == "branch" && %s ]] || [[ "${GITHUB_EVENT_NAME}" == "deployment" ]]; then echo "Setting tag/version for release/tag build."; PUBLISHVERSION=$VERSION; TAG="latest"; @@ -253,7 +261,7 @@ local yarn = import 'yarn.jsonnet'; mv package.json.bak package.json; '; - |||, + ||| % branchCheck, env={} + (if isPr then { PR_NUMBER: '${{ github.event.number }}' } else {}), ifClause=ifClause, ), @@ -264,12 +272,13 @@ local yarn = import 'yarn.jsonnet'; * @param {boolean} isPr - Whether this is a PR build (affects versioning) * @param {array} repositories - List of repository types ('gynzy' or 'github') * @param {string} [ifClause=null] - Conditional expression to determine if steps should run + * @param {string} [publishBranch=null] - The branch that triggers the publish-prod job; publishes the package specified in package.json and sets latest tag. When null, defaults to `main`/`master` * @returns {steps} - Array of step objects for publishing to all repositories */ - pnpmPublishToRepositories(isPr, repositories, ifClause=null):: + pnpmPublishToRepositories(isPr, repositories, ifClause=null, publishBranch=null):: (std.flatMap(function(repository) - if repository == 'gynzy' then [yarn.setGynzyNpmToken(ifClause=ifClause), self.pnpmPublish(isPr=isPr, ifClause=ifClause)] - else if repository == 'github' then [yarn.setGithubNpmToken(ifClause=ifClause), self.pnpmPublish(isPr=isPr, ifClause=ifClause)] + if repository == 'gynzy' then [yarn.setGynzyNpmToken(ifClause=ifClause), self.pnpmPublish(isPr=isPr, ifClause=ifClause, publishBranch=publishBranch)] + else if repository == 'github' then [yarn.setGithubNpmToken(ifClause=ifClause, tokenSecret='GITHUB_TOKEN'), self.pnpmPublish(isPr=isPr, ifClause=ifClause, publishBranch=publishBranch)] else error 'Unknown repository type given.', repositories)), @@ -281,7 +290,7 @@ local yarn = import 'yarn.jsonnet'; * @param {string} [gitCloneRef='${{ github.event.pull_request.head.sha }}'] - Git reference to checkout * @param {array} [buildSteps=null] - Build steps; null defaults to `[pnpm run build]`. Pass `[]` to skip build. * @param {boolean} [checkVersionBump=true] - Whether to check if package version was bumped - * @param {array} [repositories=['gynzy']] - List of repositories to publish to + * @param {array} [repositories=['github']] - List of repositories to publish to * @param {boolean|string} [onChangedFiles=false] - Whether to only run on changed files (or glob pattern) * @param {string} [changedFilesHeadRef=null] - Head reference for changed files comparison * @param {string} [changedFilesBaseRef=null] - Base reference for changed files comparison @@ -294,7 +303,7 @@ local yarn = import 'yarn.jsonnet'; gitCloneRef='${{ github.event.pull_request.head.sha }}', buildSteps=null, checkVersionBump=true, - repositories=['gynzy'], + repositories=['github'], onChangedFiles=false, changedFilesHeadRef=null, changedFilesBaseRef=null, @@ -327,12 +336,13 @@ local yarn = import 'yarn.jsonnet'; * @param {boolean} [useCredentials=false] - Whether to use Docker registry credentials * @param {string} [gitCloneRef='${{ github.sha }}'] - Git reference to checkout * @param {array} [buildSteps=null] - Build steps; null defaults to `[pnpm run build]`. Pass `[]` to skip build. - * @param {array} [repositories=['gynzy']] - List of repositories to publish to + * @param {array} [repositories=['github']] - List of repositories to publish to * @param {boolean|string} [onChangedFiles=false] - Whether to only run on changed files (or glob pattern) * @param {string} [changedFilesHeadRef=null] - Head reference for changed files comparison * @param {string} [changedFilesBaseRef=null] - Base reference for changed files comparison * @param {string} [ifClause=null] - Conditional expression to determine if job should run * @param {string} [runsOn=null] - Runner type to use + * @param {string} [publishBranch=null] - The branch that triggers the publish-prod job; publishes the package specified in package.json and sets latest tag. When null, defaults to `main`/`master` * @returns {jobs} - GitHub Actions job definition */ pnpmPublishJob( @@ -340,12 +350,13 @@ local yarn = import 'yarn.jsonnet'; useCredentials=false, gitCloneRef='${{ github.sha }}', buildSteps=null, - repositories=['gynzy'], + repositories=['github'], onChangedFiles=false, changedFilesHeadRef=null, changedFilesBaseRef=null, ifClause=null, runsOn=null, + publishBranch=null, ):: local effectiveBuildSteps = if buildSteps == null then [base.step('build', 'pnpm run build')] else buildSteps; local stepIfClause = (if onChangedFiles != false then "steps.changes.outputs.package == 'true'" else null); @@ -358,7 +369,7 @@ local yarn = import 'yarn.jsonnet'; [self.checkoutAndPnpm(ref=gitCloneRef, fullClone=false, source=repositories[0], pnpmInstallArgs=['--frozen-lockfile'])] + (if onChangedFiles != false then misc.testForChangedFiles({ package: onChangedFiles }, headRef=changedFilesHeadRef, baseRef=changedFilesBaseRef) else []) + (if onChangedFiles != false then std.map(function(step) std.map(function(s) s { 'if': stepIfClause }, step), effectiveBuildSteps) else effectiveBuildSteps) + - self.pnpmPublishToRepositories(isPr=false, repositories=repositories, ifClause=stepIfClause), + self.pnpmPublishToRepositories(isPr=false, repositories=repositories, ifClause=stepIfClause, publishBranch=publishBranch), permissions={ packages: 'write', contents: 'read', 'pull-requests': 'read' }, ifClause=ifClause, ), diff --git a/.github/jsonnet/yarn.jsonnet b/.github/jsonnet/yarn.jsonnet index 8f46967a..a4efa727 100644 --- a/.github/jsonnet/yarn.jsonnet +++ b/.github/jsonnet/yarn.jsonnet @@ -62,9 +62,10 @@ local misc = import 'misc.jsonnet'; * * @param {string} [ifClause=null] - Conditional expression to determine if step should run * @param {string} [workingDirectory=null] - Directory to create .npmrc file in + * @param {string} [tokenSecret='VIRKO_GITHUB_PKG_READONLY'] - Name of the secret holding the registry auth token. Defaults to a read-only token for installing packages; publish jobs pass a writable token (GITHUB_TOKEN). * @returns {steps} - Array containing a single step object */ - setGithubNpmToken(ifClause=null, workingDirectory=null):: + setGithubNpmToken(ifClause=null, workingDirectory=null, tokenSecret='VIRKO_GITHUB_PKG_READONLY'):: base.step( 'set github npm_token', run= @@ -76,7 +77,7 @@ local misc = import 'misc.jsonnet'; EOF |||, env={ - NODE_AUTH_TOKEN: misc.secret('GITHUB_TOKEN'), + NODE_AUTH_TOKEN: misc.secret(tokenSecret), }, ifClause=ifClause, workingDirectory=workingDirectory, @@ -91,14 +92,14 @@ local misc = import 'misc.jsonnet'; * @param {string} [ref=null] - Git ref to checkout (branch, tag, or commit) * @param {boolean} [prod=false] - Whether to install only production dependencies * @param {string} [workingDirectory=null] - Directory to run operations in - * @param {string} [source='gynzy'] - Registry source ('gynzy' or 'github') + * @param {string} [source='github'] - Registry source ('gynzy' or 'github') * @param {boolean} [ignoreEngines=false] - Whether to ignore engine version checks * @param {boolean} [blobless=null] - Whether to perform a blobless clone (--filter=blob:none); null uses checkout default * @param {number} [retryAttempts=null] - Number of additional checkout attempts on failure; null uses checkout default * @param {number} [cloneTimeout=null] - Timeout for git clone operation in minutes; null uses checkout default * @returns {steps} - Array of step objects for the complete workflow */ - checkoutAndYarn(cacheName=null, ifClause=null, fullClone=false, ref=null, prod=false, workingDirectory=null, source='gynzy', ignoreEngines=false, blobless=null, retryAttempts=null, cloneTimeout=null):: + checkoutAndYarn(cacheName=null, ifClause=null, fullClone=false, ref=null, prod=false, workingDirectory=null, source='github', ignoreEngines=false, blobless=null, retryAttempts=null, cloneTimeout=null):: misc.checkout(ifClause=ifClause, fullClone=fullClone, ref=ref, blobless=blobless, retryAttempts=retryAttempts, cloneTimeout=cloneTimeout) + (if source == 'gynzy' then self.setGynzyNpmToken(ifClause=ifClause, workingDirectory=workingDirectory) else []) + (if source == 'github' then self.setGithubNpmToken(ifClause=ifClause, workingDirectory=workingDirectory) else []) + @@ -171,9 +172,15 @@ local misc = import 'misc.jsonnet'; * * @param {boolean} [isPr=true] - Whether this is a PR build (affects versioning) * @param {string} [ifClause=null] - Conditional expression to determine if step should run + * @param {string} [publishBranch=null] - The branch that triggers the publish-prod job; publishes the package specified in package.json and sets latest tag. When null, defaults to `main`/`master` * @returns {steps} - Array containing a single step object */ - yarnPublish(isPr=true, ifClause=null):: + yarnPublish(isPr=true, ifClause=null, publishBranch=null):: + local branchCheck = + if publishBranch == null then + '( "${GITHUB_REF_NAME}" == "main" || "${GITHUB_REF_NAME}" == "master" )' + else + '"${GITHUB_REF_NAME}" == "' + publishBranch + '"'; base.step( 'publish', ||| @@ -194,7 +201,7 @@ local misc = import 'misc.jsonnet'; echo "Setting tag/version for release/tag build."; PUBLISHVERSION=$VERSION; TAG="latest"; - elif [[ "${GITHUB_REF_TYPE}" == "branch" && ( "${GITHUB_REF_NAME}" == "main" || "${GITHUB_REF_NAME}" == "master" ) ]] || [[ "${GITHUB_EVENT_NAME}" == "deployment" ]]; then + elif [[ "${GITHUB_REF_TYPE}" == "branch" && %s ]] || [[ "${GITHUB_EVENT_NAME}" == "deployment" ]]; then echo "Setting tag/version for release/tag build."; PUBLISHVERSION=$VERSION; TAG="latest"; @@ -206,7 +213,7 @@ local misc = import 'misc.jsonnet'; mv package.json.bak package.json; '; - |||, + ||| % branchCheck, env={} + (if isPr then { PR_NUMBER: '${{ github.event.number }}' } else {}), ifClause=ifClause, ), @@ -217,12 +224,13 @@ local misc = import 'misc.jsonnet'; * @param {boolean} isPr - Whether this is a PR build (affects versioning) * @param {array} repositories - List of repository types ('gynzy' or 'github') * @param {string} [ifClause=null] - Conditional expression to determine if steps should run + * @param {string} [publishBranch=null] - The branch that triggers the publish-prod job; publishes the package specified in package.json and sets latest tag. When null, defaults to `main`/`master` * @returns {steps} - Array of step objects for publishing to all repositories */ - yarnPublishToRepositories(isPr, repositories, ifClause=null):: + yarnPublishToRepositories(isPr, repositories, ifClause=null, publishBranch=null):: (std.flatMap(function(repository) - if repository == 'gynzy' then [self.setGynzyNpmToken(ifClause=ifClause), self.yarnPublish(isPr=isPr, ifClause=ifClause)] - else if repository == 'github' then [self.setGithubNpmToken(ifClause=ifClause), self.yarnPublish(isPr=isPr, ifClause=ifClause)] + if repository == 'gynzy' then [self.setGynzyNpmToken(ifClause=ifClause), self.yarnPublish(isPr=isPr, ifClause=ifClause, publishBranch=publishBranch)] + else if repository == 'github' then [self.setGithubNpmToken(ifClause=ifClause, tokenSecret='GITHUB_TOKEN'), self.yarnPublish(isPr=isPr, ifClause=ifClause, publishBranch=publishBranch)] else error 'Unknown repository type given.', repositories)), @@ -235,7 +243,7 @@ local misc = import 'misc.jsonnet'; * @param {string} [gitCloneRef='${{ github.event.pull_request.head.sha }}'] - Git reference to checkout * @param {array} [buildSteps=[base.step('build', 'yarn build')]] - Build steps to run before publishing * @param {boolean} [checkVersionBump=true] - Whether to check if package version was bumped - * @param {array} [repositories=['gynzy']] - List of repositories to publish to + * @param {array} [repositories=['github']] - List of repositories to publish to * @param {boolean|string} [onChangedFiles=false] - Whether to only run on changed files (or glob pattern) * @param {string} [changedFilesHeadRef=null] - Head reference for changed files comparison * @param {string} [changedFilesBaseRef=null] - Base reference for changed files comparison @@ -248,7 +256,7 @@ local misc = import 'misc.jsonnet'; gitCloneRef='${{ github.event.pull_request.head.sha }}', buildSteps=[base.step('build', 'yarn build')], checkVersionBump=true, - repositories=['gynzy'], + repositories=['github'], onChangedFiles=false, changedFilesHeadRef=null, changedFilesBaseRef=null, @@ -280,12 +288,13 @@ local misc = import 'misc.jsonnet'; * @param {boolean} [useCredentials=false] - Whether to use Docker registry credentials * @param {string} [gitCloneRef='${{ github.sha }}'] - Git reference to checkout * @param {array} [buildSteps=[base.step('build', 'yarn build')]] - Build steps to run before publishing - * @param {array} [repositories=['gynzy']] - List of repositories to publish to + * @param {array} [repositories=['github']] - List of repositories to publish to * @param {boolean|string} [onChangedFiles=false] - Whether to only run on changed files (or glob pattern) * @param {string} [changedFilesHeadRef=null] - Head reference for changed files comparison * @param {string} [changedFilesBaseRef=null] - Base reference for changed files comparison * @param {string} [ifClause=null] - Conditional expression to determine if job should run * @param {string} [runsOn=null] - Runner type to use + * @param {string} [publishBranch=null] - The branch that triggers the publish-prod job; publishes the package specified in package.json and sets latest tag. When null, defaults to `main`/`master` * @returns {jobs} - GitHub Actions job definition */ yarnPublishJob( @@ -293,12 +302,13 @@ local misc = import 'misc.jsonnet'; useCredentials=false, gitCloneRef='${{ github.sha }}', buildSteps=[base.step('build', 'yarn build')], - repositories=['gynzy'], + repositories=['github'], onChangedFiles=false, changedFilesHeadRef=null, changedFilesBaseRef=null, ifClause=null, runsOn=null, + publishBranch=null, ):: local stepIfClause = (if onChangedFiles != false then "steps.changes.outputs.package == 'true'" else null); base.ghJob( @@ -310,7 +320,7 @@ local misc = import 'misc.jsonnet'; [self.checkoutAndYarn(ref=gitCloneRef, fullClone=false)] + (if onChangedFiles != false then misc.testForChangedFiles({ package: onChangedFiles }, headRef=changedFilesHeadRef, baseRef=changedFilesBaseRef) else []) + (if onChangedFiles != false then std.map(function(step) std.map(function(s) s { 'if': stepIfClause }, step), buildSteps) else buildSteps) + - self.yarnPublishToRepositories(isPr=false, repositories=repositories, ifClause=stepIfClause), + self.yarnPublishToRepositories(isPr=false, repositories=repositories, ifClause=stepIfClause, publishBranch=publishBranch), permissions={ packages: 'write', contents: 'read', 'pull-requests': 'read' }, ifClause=ifClause, ), diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index a85ad6a7..483ebe0e 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -69,7 +69,7 @@ - "name": "git safe directory" "run": "command -v git && git config --global --add safe.directory '*' || true" - "env": - "NODE_AUTH_TOKEN": "${{ secrets.GITHUB_TOKEN }}" + "NODE_AUTH_TOKEN": "${{ secrets.VIRKO_GITHUB_PKG_READONLY }}" "name": "set github npm_token" "run": | cat < .npmrc @@ -128,49 +128,6 @@ npm version --no-git-tag-version --allow-same-version "$PUBLISHVERSION"; pnpm publish --no-git-checks --tag "$TAG"; - mv package.json.bak package.json; - '; - - "env": - "NPM_TOKEN": "${{ secrets.npm_token }}" - "name": "set gynzy npm_token" - "run": | - cat < .npmrc - @gynzy:registry=https://npm.gynzy.net/ - "//npm.gynzy.net/:_authToken"="${NPM_TOKEN}" - public-hoist-pattern[]=@pulumi/pulumi - EOF - - "env": - "PR_NUMBER": "${{ github.event.number }}" - "name": "publish" - "run": | - bash -c 'set -xeo pipefail; - - cp package.json package.json.bak; - - VERSION=$(node -p "require(\"./package.json\").version"); - if [[ ! -z "${PR_NUMBER}" ]]; then - echo "Setting tag/version for pr build."; - TAG=pr-$PR_NUMBER; - PUBLISHVERSION="$VERSION-pr$PR_NUMBER.$GITHUB_RUN_NUMBER"; - elif [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then - if [[ "${GITHUB_REF_NAME}" != "${VERSION}" ]]; then - echo "Tag version does not match package version. They should match. Exiting"; - exit 1; - fi - echo "Setting tag/version for release/tag build."; - PUBLISHVERSION=$VERSION; - TAG="latest"; - elif [[ "${GITHUB_REF_TYPE}" == "branch" && ( "${GITHUB_REF_NAME}" == "main" || "${GITHUB_REF_NAME}" == "master" ) ]] || [[ "${GITHUB_EVENT_NAME}" == "deployment" ]]; then - echo "Setting tag/version for release/tag build."; - PUBLISHVERSION=$VERSION; - TAG="latest"; - else - exit 1 - fi - - npm version --no-git-tag-version --allow-same-version "$PUBLISHVERSION"; - pnpm publish --no-git-checks --tag "$TAG"; - mv package.json.bak package.json; '; "timeout-minutes": 30 diff --git a/.github/workflows/publish-prod.yml b/.github/workflows/publish-prod.yml index 4bf66a08..53824eff 100644 --- a/.github/workflows/publish-prod.yml +++ b/.github/workflows/publish-prod.yml @@ -69,7 +69,7 @@ - "name": "git safe directory" "run": "command -v git && git config --global --add safe.directory '*' || true" - "env": - "NODE_AUTH_TOKEN": "${{ secrets.GITHUB_TOKEN }}" + "NODE_AUTH_TOKEN": "${{ secrets.VIRKO_GITHUB_PKG_READONLY }}" "name": "set github npm_token" "run": | cat < .npmrc @@ -112,49 +112,7 @@ echo "Setting tag/version for release/tag build."; PUBLISHVERSION=$VERSION; TAG="latest"; - elif [[ "${GITHUB_REF_TYPE}" == "branch" && ( "${GITHUB_REF_NAME}" == "main" || "${GITHUB_REF_NAME}" == "master" ) ]] || [[ "${GITHUB_EVENT_NAME}" == "deployment" ]]; then - echo "Setting tag/version for release/tag build."; - PUBLISHVERSION=$VERSION; - TAG="latest"; - else - exit 1 - fi - - npm version --no-git-tag-version --allow-same-version "$PUBLISHVERSION"; - pnpm publish --no-git-checks --tag "$TAG"; - - mv package.json.bak package.json; - '; - - "env": - "NPM_TOKEN": "${{ secrets.npm_token }}" - "name": "set gynzy npm_token" - "run": | - cat < .npmrc - @gynzy:registry=https://npm.gynzy.net/ - "//npm.gynzy.net/:_authToken"="${NPM_TOKEN}" - public-hoist-pattern[]=@pulumi/pulumi - EOF - - "env": {} - "name": "publish" - "run": | - bash -c 'set -xeo pipefail; - - cp package.json package.json.bak; - - VERSION=$(node -p "require(\"./package.json\").version"); - if [[ ! -z "${PR_NUMBER}" ]]; then - echo "Setting tag/version for pr build."; - TAG=pr-$PR_NUMBER; - PUBLISHVERSION="$VERSION-pr$PR_NUMBER.$GITHUB_RUN_NUMBER"; - elif [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then - if [[ "${GITHUB_REF_NAME}" != "${VERSION}" ]]; then - echo "Tag version does not match package version. They should match. Exiting"; - exit 1; - fi - echo "Setting tag/version for release/tag build."; - PUBLISHVERSION=$VERSION; - TAG="latest"; - elif [[ "${GITHUB_REF_TYPE}" == "branch" && ( "${GITHUB_REF_NAME}" == "main" || "${GITHUB_REF_NAME}" == "master" ) ]] || [[ "${GITHUB_EVENT_NAME}" == "deployment" ]]; then + elif [[ "${GITHUB_REF_TYPE}" == "branch" && "${GITHUB_REF_NAME}" == "main" ]] || [[ "${GITHUB_EVENT_NAME}" == "deployment" ]]; then echo "Setting tag/version for release/tag build."; PUBLISHVERSION=$VERSION; TAG="latest";