Publish #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| package: | |
| description: Which package to publish | |
| required: true | |
| type: choice | |
| options: | |
| - both | |
| - typescript | |
| - python | |
| default: both | |
| dry_run: | |
| description: Build and verify without publishing | |
| required: false | |
| type: boolean | |
| default: false | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: runinfra-sdk-publish-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| publish-npm: | |
| name: Publish TypeScript SDK | |
| if: ${{ github.event.inputs.package == 'typescript' || github.event.inputs.package == 'both' }} | |
| runs-on: ubuntu-latest | |
| environment: npm | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Verify version sync | |
| run: node scripts/verify-version-sync.mjs | |
| - name: Setup Node | |
| # Note: do NOT set `registry-url` here. It creates an .npmrc with | |
| # a token placeholder, which makes the CLI demand token auth | |
| # instead of using OIDC. The publish step sets the registry inline. | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22.14.0 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 9 | |
| - name: Install dependencies | |
| working-directory: typescript | |
| run: pnpm install --lockfile=false | |
| - name: Type-check | |
| working-directory: typescript | |
| run: pnpm exec tsc -p tsconfig.json --noEmit | |
| - name: Test | |
| working-directory: typescript | |
| run: pnpm test | |
| - name: Build | |
| working-directory: typescript | |
| run: pnpm build | |
| - name: Pack | |
| working-directory: typescript | |
| run: pnpm pack | |
| - name: Verify tarball contents (no leaks) | |
| working-directory: typescript | |
| run: | | |
| TGZ=$(ls runinfra-sdk-*.tgz) | |
| echo "=== Tarball: $TGZ ===" | |
| node ../scripts/verify-npm-package.mjs "$TGZ" | |
| - name: Install npm trusted publishing CLI | |
| run: | | |
| npm install -g npm@11.5.1 | |
| npm --version | |
| - name: Publish to npm | |
| if: ${{ github.event.inputs.dry_run != 'true' }} | |
| working-directory: typescript | |
| run: | | |
| # npm 11.5.1+ with id-token: write permission performs OIDC trusted | |
| # publishing automatically when --provenance is used and no other | |
| # auth is configured. | |
| npm config set registry https://registry.npmjs.org/ | |
| npm publish runinfra-sdk-*.tgz --access public --provenance | |
| - name: Dry-run summary | |
| if: ${{ github.event.inputs.dry_run == 'true' }} | |
| working-directory: typescript | |
| run: | | |
| echo 'Dry run - would have published:' | |
| ls -la runinfra-sdk-*.tgz | |
| publish-pypi: | |
| name: Publish Python SDK | |
| if: ${{ github.event.inputs.package == 'python' || github.event.inputs.package == 'both' }} | |
| runs-on: ubuntu-latest | |
| environment: pypi | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Verify version sync | |
| run: node scripts/verify-version-sync.mjs | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install build + test tools | |
| run: python -m pip install --upgrade build pytest twine | |
| - name: Test | |
| working-directory: python | |
| run: | | |
| python -m pip install -e . | |
| python -m pytest tests/ -v | |
| - name: Build sdist + wheel | |
| working-directory: python | |
| run: python -m build | |
| - name: Verify build artifacts (no leaks) | |
| working-directory: python | |
| run: | | |
| ls -la dist/ | |
| test -n "$(ls dist/runinfra-*.whl 2>/dev/null)" || (echo 'no wheel' && exit 1) | |
| test -n "$(ls dist/runinfra-*.tar.gz 2>/dev/null)" || (echo 'no sdist' && exit 1) | |
| python ../scripts/verify-python-package.py dist | |
| twine check dist/* | |
| - name: Publish to PyPI | |
| if: ${{ github.event.inputs.dry_run != 'true' }} | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| with: | |
| packages-dir: python/dist | |
| - name: Dry-run summary | |
| if: ${{ github.event.inputs.dry_run == 'true' }} | |
| working-directory: python | |
| run: | | |
| echo 'Dry run - would have published:' | |
| ls -la dist/ |