68 lines
2.9 KiB
YAML
68 lines
2.9 KiB
YAML
|
name: Publish (forge)
|
||
|
|
|
||
|
|
# Datacenter-side forge publish, moved off the laptop: an 87MB tarball PUT
|
||
|
|
# over the laptop's WAN times out; the forge's own runner does it in seconds.
|
||
|
|
# scripts/release.sh tags + pushes, then polls this workflow's result (npm
|
||
|
|
# view against the forge registry) before it ever touches the npmjs leg —
|
||
|
|
# see the "delegation contract" in scripts/release.sh's forge-publish step.
|
||
|
|
|
||
|
|
on:
|
||
|
|
push:
|
||
|
|
tags:
|
||
|
|
- 'v*'
|
||
|
|
|
||
|
|
jobs:
|
||
|
|
publish:
|
||
|
|
name: Publish to the forge registry
|
||
|
|
runs-on: ubuntu-latest
|
||
|
|
steps:
|
||
|
|
- uses: actions/checkout@v4
|
||
|
|
- uses: actions/setup-node@v4
|
||
|
|
with:
|
||
|
|
node-version: '22'
|
||
|
|
cache: npm
|
||
|
|
- run: npm ci
|
||
|
|
- run: npm run build
|
||
|
|
- name: Publish + readback-verify on the forge registry
|
||
|
|
env:
|
||
|
|
FORGE_NPM_TOKEN: ${{ secrets.FORGE_NPM_TOKEN }}
|
||
|
|
run: |
|
||
|
|
set -eo pipefail
|
||
|
|
|
||
|
|
FORGE_NPM_REG="https://source.soulcraft.com/api/packages/soulcraft/npm/"
|
||
|
|
VERSION="$(node -p "require('./package.json').version")"
|
||
|
|
echo "Publishing @soulcraft/brainy@${VERSION} to the forge registry..."
|
||
|
|
|
||
|
|
TMPRC="$(mktemp)"
|
||
|
|
chmod 600 "$TMPRC"
|
||
|
|
{
|
||
|
|
echo "@soulcraft:registry=${FORGE_NPM_REG}"
|
||
|
|
echo "//source.soulcraft.com/api/packages/soulcraft/npm/:_authToken=${FORGE_NPM_TOKEN}"
|
||
|
|
} > "$TMPRC"
|
||
|
|
|
||
|
|
# The release script bumps package.json's version before it tags, so
|
||
|
|
# this tag's checkout already carries the version being published —
|
||
|
|
# nothing here re-derives it from the tag name.
|
||
|
|
PUBLISH_OK=true
|
||
|
|
if ! npm publish --tag latest --userconfig "$TMPRC"; then
|
||
|
|
PUBLISH_OK=false
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Readback verify is the source of truth, run regardless of the publish
|
||
|
|
# exit code: a benign duplicate publish (a prior run, or a mirror, already
|
||
|
|
# landed this exact version) reports failure even though the registry
|
||
|
|
# already holds the right content.
|
||
|
|
LANDED_VERSION="$(npm view "@soulcraft/brainy@${VERSION}" version --userconfig "$TMPRC" 2>/dev/null || echo "")"
|
||
|
|
rm -f "$TMPRC"
|
||
|
|
|
||
|
|
if [ "$LANDED_VERSION" != "$VERSION" ]; then
|
||
|
|
echo "::error::Readback verify FAILED — the forge registry reports version '${LANDED_VERSION:-<none>}', expected '${VERSION}'. This is a genuine publish failure, not a benign duplicate."
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ "$PUBLISH_OK" = true ]; then
|
||
|
|
echo "Published and verified @soulcraft/brainy@${VERSION} on the forge registry."
|
||
|
|
else
|
||
|
|
echo "::warning::npm publish reported failure, but readback confirms @soulcraft/brainy@${VERSION} is already live on the forge (a prior run or mirror landed it) — treating this run as successful, since the registry content is correct. Any OTHER failure mode would have failed the readback check above instead."
|
||
|
|
fi
|