tldr-lint/.github/workflows/publish.yml at 64af62883871bb4405fba6bb105df107c018d3f5 · tldr-pages/tldr-lint · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
# This workflow automatically publishes the package to NPM and GHCR when a new tag is created/pushed.
# Before, tagging a new release, make sure to update the version in package.json file.
# The NPM package is published using Trusted Publishers using OIDC (without a PAT) when a release is created
# and the deployment is approved by an admin.


name: Publish Release
on:
  push:
    tags:
      - 'v*'


jobs:
  create-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write # Required to create a release
    steps:
      - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0

      - name: Create GitHub Release with changelog
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG_NAME=${GITHUB_REF#refs/tags/}
          gh release create "$TAG_NAME" --generate-notes --title "$TAG_NAME" --verify-tag || echo "Release may already exist."

  publish-npm:
    runs-on: ubuntu-latest
    needs: create-release

    environment:
      name: npm
      url: https://www.npmjs.com/package/tldr-lint

    permissions:
      contents: read
      id-token: write # Required for OIDC in NPM Trusted Publishing

    steps:
      - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0

      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: '22.x'
          registry-url: 'https://registry.npmjs.org'

      - name: Update npm
        run: npm install -g npm@latest

      - run: npm ci
      - run: npm publish

  publish-ghcr:
    runs-on: ubuntu-latest
    needs: create-release
    permissions:
      contents: read
      packages: write # Allow pushing images to GHCR
      attestations: write # Required to create and write attestations
      id-token: write # Additional permissions for the persistence of the attestations

    env:
      BUILDX_NO_DEFAULT_ATTESTATIONS: 1

    steps:
      - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0

      - name: Set image name
        run: |
          echo "IMAGE_URL=ghcr.io/tldr-pages/tldr-lint">> "$GITHUB_ENV"

      - name: Docker meta
        id: docker_meta
        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
        with:
          images: |
            ${{ env.IMAGE_URL }}
          tags: |
            type=raw,value=latest
            type=raw,value=${{ github.ref_name }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Login to GitHub Package Registry
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and Push the Docker image
        id: push
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          file: Dockerfile
          push: true
          tags: ${{ steps.docker_meta.outputs.tags }}
          labels: ${{ steps.docker_meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64
          provenance: false

      - name: Attest pushed image
        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
        id: attest
        with:
          subject-name: ${{ env.IMAGE_URL }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: false