79 lines
3.6 KiB
YAML
79 lines
3.6 KiB
YAML
name: Publish (The Source)
|
|
|
|
# Datacenter-side publish to The Source (source.soulcraft.com — our
|
|
# self-hosted Forgejo; never call it "the forge", Forge is a different
|
|
# product), moved off the laptop: an 87MB tarball PUT over the laptop's WAN
|
|
# times out; The Source's own runner does it in seconds.
|
|
# scripts/release.sh tags + pushes, then polls this workflow's result (npm
|
|
# view against The Source's registry) before it ever touches the npmjs leg —
|
|
# see the "delegation contract" in scripts/release.sh's home-publish step.
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
publish:
|
|
name: Publish to The Source registry
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '22'
|
|
cache: npm
|
|
- run: npm ci
|
|
- run: npm run build
|
|
- name: Publish + readback-verify on The Source registry
|
|
env:
|
|
# The stored repo-settings secret keeps its historical name.
|
|
FORGE_NPM_TOKEN: ${{ secrets.FORGE_NPM_TOKEN }}
|
|
run: |
|
|
set -eo pipefail
|
|
|
|
SOURCE_NPM_REG="https://source.soulcraft.com/api/packages/soulcraft/npm/"
|
|
VERSION="$(node -p "require('./package.json').version")"
|
|
# The dist-tag follows the version: a prerelease (any hyphen —
|
|
# 10.4.0-rc.1) publishes under 'rc' and must NEVER move 'latest' —
|
|
# every consumer resolving 'latest' from this registry would otherwise
|
|
# be handed a release candidate. Same rule scripts/release.sh applies
|
|
# to the storefront leg.
|
|
NPM_TAG="latest"
|
|
case "$VERSION" in
|
|
*-*) NPM_TAG="rc" ;;
|
|
esac
|
|
echo "Publishing @soulcraft/brainy@${VERSION} to The Source registry (dist-tag: ${NPM_TAG})..."
|
|
|
|
TMPRC="$(mktemp)"
|
|
chmod 600 "$TMPRC"
|
|
{
|
|
echo "@soulcraft:registry=${SOURCE_NPM_REG}"
|
|
echo "//source.soulcraft.com/api/packages/soulcraft/npm/:_authToken=${FORGE_NPM_TOKEN}"
|
|
} > "$TMPRC"
|
|
|
|
# The release script bumps package.json's version before it tags, so
|
|
# this tag's checkout already carries the version being published —
|
|
# nothing here re-derives it from the tag name.
|
|
PUBLISH_OK=true
|
|
if ! npm publish --tag "$NPM_TAG" --userconfig "$TMPRC"; then
|
|
PUBLISH_OK=false
|
|
fi
|
|
|
|
# Readback verify is the source of truth, run regardless of the publish
|
|
# exit code: a benign duplicate publish (a prior run, or a mirror, already
|
|
# landed this exact version) reports failure even though the registry
|
|
# already holds the right content.
|
|
LANDED_VERSION="$(npm view "@soulcraft/brainy@${VERSION}" version --userconfig "$TMPRC" 2>/dev/null || echo "")"
|
|
rm -f "$TMPRC"
|
|
|
|
if [ "$LANDED_VERSION" != "$VERSION" ]; then
|
|
echo "::error::Readback verify FAILED — The Source registry reports version '${LANDED_VERSION:-<none>}', expected '${VERSION}'. This is a genuine publish failure, not a benign duplicate."
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$PUBLISH_OK" = true ]; then
|
|
echo "Published and verified @soulcraft/brainy@${VERSION} on The Source registry."
|
|
else
|
|
echo "::warning::npm publish reported failure, but readback confirms @soulcraft/brainy@${VERSION} is already live on The Source (a prior run or mirror landed it) — treating this run as successful, since the registry content is correct. Any OTHER failure mode would have failed the readback check above instead."
|
|
fi
|