automation/.github/workflows/openpi-release.yml at main · openpi-dev/automation · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
name: OpenPI release

on:
  workflow_call:
    inputs:
      tag:
        description: Existing version tag to publish
        required: true
        type: string

permissions:
  contents: read

jobs:
  validate:
    name: Validate release
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Resolve release source
        id: source
        uses: openpi-dev/automation/actions/openpi-release-validation@df7b1ee59baae8a48b6930bbb0cc21f9571a8280
        with:
          mode: resolve
          release_tag: ${{ inputs.tag }}
          event_name: ${{ github.event_name }}
          ref: ${{ github.ref }}
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0
          ref: ${{ steps.source.outputs.tag }}
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          package-manager-cache: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14
      - name: Install dependencies
        run: bun install --frozen-lockfile
      - run: bun run check
      - run: bun run test
      - name: Verify package version
        uses: openpi-dev/automation/actions/openpi-release-validation@df7b1ee59baae8a48b6930bbb0cc21f9571a8280
        with:
          mode: verify-package
          release_tag: ${{ steps.source.outputs.tag }}
      - name: Verify tagged release ancestry
        run: |
          git fetch --no-tags origin main:refs/remotes/origin/main
          git merge-base --is-ancestor HEAD origin/main
      - name: Verify package contents
        run: npm pack --dry-run --ignore-scripts
      - name: Build release artifact
        run: |
          mkdir release-artifact
          npm pack --ignore-scripts --pack-destination release-artifact
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: npm-package
          path: release-artifact/*.tgz
          if-no-files-found: error
          retention-days: 1

  publish:
    name: Publish to npm
    needs: validate
    runs-on: ubuntu-latest
    timeout-minutes: 5
    environment: npm
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          package-manager-cache: false
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: npm-package
          path: release-artifact
      - name: Publish package
        run: |
          mapfile -t packages < <(find "$PWD/release-artifact" -maxdepth 1 -type f -name '*.tgz' -print)
          test "${#packages[@]}" -eq 1
          npm publish "${packages[0]}" --ignore-scripts --access public