Skip to content

Commit b3b1bcc

Browse files
rfgamaralrfgamaral
authored
ci: Enable trusted publishing and npm provenance (#975)
1 parent af8bfeb commit b3b1bcc

File tree

9 files changed

+106
-65
lines changed

9 files changed

+106
-65
lines changed

‎.github/workflows/chromatic.yml‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,23 +7,32 @@ jobs:
77
runs-on: ubuntu-latest
88
steps:
99
- name: Checkout repository
10-
uses: actions/checkout@v4
10+
uses: actions/checkout@v5
1111
with:
1212
fetch-depth: 0
1313

1414
- name: Prepare Node.js environment
15-
uses: actions/setup-node@v3
15+
uses: actions/setup-node@v6
1616
with:
17-
node-version-file: '.nvmrc'
17+
node-version-file: '.node-version'
1818
registry-url: https://npm.pkg.github.com
1919
scope: '@doist'
2020

21-
- name: Install dependencies
22-
run: npm install
21+
- name: Cache project 'node_modules' directory
22+
id: node-modules-cache
23+
uses: actions/cache@v4
24+
with:
25+
key: node-modules-cache-${{ hashFiles('**/package-lock.json', '**/.node-version') }}
26+
path: node_modules/
27+
28+
- name: Install project npm dependencies
29+
if: ${{ steps.node-modules-cache.outputs.cache-hit != 'true' }}
30+
run: npm ci
2331

2432
- name: Publish to Chromatic
2533
uses: chromaui/action@d7afd50124cf4f337bcd943e7f45cfa85a5e4476
2634
with:
2735
projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
2836
skip: dependabot/**
2937
onlyChanged: true
38+
buildScriptName: build:storybook

‎.github/workflows/deploy-storybook.yml‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -28,19 +28,23 @@ jobs:
2828
runs-on: ubuntu-latest
2929
steps:
3030
- name: Checkout
31-
uses: actions/checkout@v4
31+
uses: actions/checkout@v5
3232

33-
- name: Read Node.js version from '.nvmrc'
34-
id: nvmrc
35-
run: |
36-
echo "NODE_VERSION=$(cat .nvmrc)" >> $GITHUB_OUTPUT
33+
- name: Prepare Node.js environment
34+
uses: actions/setup-node@v6
35+
with:
36+
cache: npm
37+
node-version-file: .node-version
3738

38-
- name: Setup Node.js
39-
uses: actions/setup-node@v1
39+
- name: Cache project 'node_modules' directory
40+
id: node-modules-cache
41+
uses: actions/cache@v4
4042
with:
41-
node-version: ${{ steps.nvmrc.outputs.NODE_VERSION }}
43+
key: node-modules-cache-${{ hashFiles('**/package-lock.json', '**/.node-version') }}
44+
path: node_modules/
4245

43-
- name: Install dependencies
46+
- name: Install project npm dependencies
47+
if: ${{ steps.node-modules-cache.outputs.cache-hit != 'true' }}
4448
run: npm ci
4549

4650
- name: Build storybook

‎.github/workflows/publish.yml‎

Lines changed: 37 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -23,51 +23,56 @@ jobs:
2323
# Based on historical data
2424
timeout-minutes: 60
2525
steps:
26-
- uses: actions/checkout@v4
26+
- name: Checkout repository
27+
uses: actions/checkout@v5
2728

2829
- name: Prepare Node.js environment
29-
uses: actions/setup-node@v3
30+
uses: actions/setup-node@v6
3031
with:
31-
node-version-file: '.nvmrc'
32+
cache: npm
33+
node-version-file: .node-version
3234

33-
# Temporarily disabled until we can upgrade to Node.js 20+
34-
# ref: https://github.com/Doist/reactist/actions/runs/18786284512/job/53605250671
35-
# - name: Ensure npm 11.5.1 or later is installed
36-
# run: npm install -g npm@latest
35+
- name: Cache project 'node_modules' directory
36+
id: node-modules-cache
37+
uses: actions/cache@v4
38+
with:
39+
key: node-modules-cache-${{ hashFiles('**/package-lock.json', '**/.node-version') }}
40+
path: node_modules/
41+
42+
- name: Ensure npm 11.5.1 or later is installed
43+
run: npm install -g npm@latest
3744

38-
# Remove any registry configurations from .npmrc
39-
- run: sed -i "/@doist/d" ./.npmrc
45+
- name: Install project npm dependencies
46+
if: ${{ steps.node-modules-cache.outputs.cache-hit != 'true' }}
47+
run: |
48+
npm ci
4049
41-
- run: npm ci
4250
- run: npm run lint
4351
- run: npm run type-check
4452
- run: npm test
45-
46-
# Build artifacts for publishing
4753
- run: npm run build
4854

49-
# Publish to GitHub package registry
50-
- name: Publish to GitHub Package Registry
51-
uses: actions/setup-node@v3
52-
with:
53-
node-version-file: '.nvmrc'
54-
registry-url: https://npm.pkg.github.com/
55-
scope: '@doist'
56-
- run: npm publish
57-
env:
58-
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
55+
# The Node.js environment is prepared based on the `.npmrc` file in the repo, which
56+
# configures Doist scoped packages to use the public npm registry with OIDC
57+
# authentication for the initial `semantic-release` publish, after which we remove the
58+
# Doist registry configuration, and prepare the Node.js environment for the GitHub
59+
# Packages registry, providing a predictable release workflow for both registries.
60+
61+
- name: Publish package to public npm registry
62+
run: npm publish
5963

60-
- name: Clear npm config between GitHub/npm registries
61-
run: rm -f $NPM_CONFIG_USERCONFIG
64+
- name: Remove Doist registry configuration from `.npmrc`
65+
run: npm config delete @doist:registry --location=project
6266

63-
# Publish to npm registry
64-
- name: Publish to npm registry
65-
uses: actions/setup-node@v3
67+
- name: Prepare Node.js environment for GitHub Packages registry
68+
uses: actions/setup-node@v6
6669
with:
67-
node-version-file: '.nvmrc'
68-
registry-url: https://registry.npmjs.org/
70+
cache: npm
71+
node-version-file: .node-version
72+
registry-url: https://npm.pkg.github.com/
6973
scope: '@doist'
70-
- run: npm publish --provenance --access public
71-
# Token-based authentication until we can use OIDC
74+
75+
- name: Publish package to private GitHub Packages registry
76+
run: npm publish
7277
env:
73-
NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
78+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/pull_request.yml‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,26 @@ jobs:
88
# Based on historical data
99
timeout-minutes: 15
1010
steps:
11-
- uses: actions/checkout@v4
11+
- name: Checkout repository
12+
uses: actions/checkout@v5
1213

1314
- name: Prepare Node.js environment
14-
uses: actions/setup-node@v3
15+
uses: actions/setup-node@v6
1516
with:
16-
node-version-file: '.nvmrc'
17+
cache: npm
18+
node-version-file: .node-version
19+
20+
- name: Cache project 'node_modules' directory
21+
id: node-modules-cache
22+
uses: actions/cache@v4
23+
with:
24+
key: node-modules-cache-${{ hashFiles('**/package-lock.json', '**/.node-version') }}
25+
path: node_modules/
26+
27+
- name: Install project npm dependencies
28+
if: ${{ steps.node-modules-cache.outputs.cache-hit != 'true' }}
29+
run: npm ci
1730

18-
- run: npm ci
1931
- run: npm run lint
2032
- run: npm run type-check
2133
- run: npm test

‎.node-version‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
22.14

‎.npmrc‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
1-
# Ensure dependencies are installed from the npm registry instead of GitHub
2-
# if you've defined the default registry for @doist in another .npmrc
1+
# Ensure dependencies are installed from the npm Registry instead of GitHub Packages in case you
2+
# have changed the default registry for the `@doist` scope in a parent `.npmrc` file
33
@doist:registry=https://registry.npmjs.org/
44

55
# Refuse to install any package incompatible with the current Node.js version
6-
engine-strict=true
6+
engine-strict=true
7+
8+
# Save dependencies with an exact version rather than the semver range
9+
save-exact=true

‎.nvmrc‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎package-lock.json‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,16 +21,24 @@
2121
"sideEffects": [
2222
"**/*.css"
2323
],
24-
"files": [
25-
"dist",
26-
"es",
27-
"lib",
28-
"styles"
29-
],
3024
"engines": {
31-
"node": "^16.0.0 || ^18.0.0 || ^20.0.0 || ^21.0.0 || ^22.0.0",
32-
"npm": "^8.3.0 || ^9.0.0 || ^10.0.0 || ^11.0.0"
25+
"node": "^22.14.0 || >= 24.10.0",
26+
"npm": "^10.9.2 || >= 11.5.1"
27+
},
28+
"publishConfig": {
29+
"access": "public"
3330
},
31+
"files": [
32+
"CHANGELOG.md",
33+
"CODE_OF_CONDUCT.md",
34+
"CONTRIBUTING.md",
35+
"LICENSE",
36+
"README.md",
37+
"dist/**",
38+
"es/**",
39+
"lib/**",
40+
"styles/**"
41+
],
3442
"scripts": {
3543
"postinstall": "patch-package",
3644
"setup": "npm install && npm run validate",
@@ -41,7 +49,7 @@
4149
"poststart:yalc": "yalc installations clean",
4250
"start:yalc:success": "./scripts/organize-styles.sh && yalc push --sig",
4351
"build": "scripts/build.sh",
44-
"build:storybook": "build-storybook -o docs",
52+
"build:storybook": "NODE_OPTIONS=--openssl-legacy-provider build-storybook -o docs",
4553
"clean": "rimraf es lib styles dist",
4654
"test": "jest --passWithNoTests",
4755
"test:watch": "npm run test -- --watch",

0 commit comments

Comments
 (0)