diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index add3b75..6ac1330 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,18 +1,40 @@ -name: Publish to npm +name: Release +# Keep the file name: npm's trusted publisher for fetchff is bound to publish.yml on: release: types: [published] workflow_dispatch: -permissions: - contents: read - id-token: write # Required for OIDC +permissions: {} + +concurrency: + group: release + cancel-in-progress: false jobs: - publish: + release: + name: Release runs-on: ubuntu-latest + environment: + name: npm + url: https://www.npmjs.com/package/fetchff + permissions: + contents: read + id-token: write # Required for OIDC steps: + # github.triggering_actor is the user who started this run, or re-ran it + - name: Check that an admin started the release + env: + GH_TOKEN: ${{ github.token }} + ACTOR: ${{ github.triggering_actor }} + run: | + permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" --jq .permission) + if [ "$permission" != "admin" ]; then + echo "::error::Only admins can publish to npm, and $ACTOR has $permission access." + exit 1 + fi + - uses: actions/checkout@v7 - uses: actions/setup-node@v7 @@ -21,9 +43,23 @@ jobs: registry-url: "https://registry.npmjs.org" package-manager-cache: false # Never publish a build made from cached dependencies + - name: Check that the release tag matches the version + if: github.event_name == 'release' + env: + TAG: ${{ github.event.release.tag_name }} + run: | + version=$(node -p "require('./package.json').version") + if [ "${TAG#v}" != "$version" ]; then + echo "::error::The release tag $TAG does not match version $version in package.json." + exit 1 + fi + - name: Install dependencies run: npm ci + - name: Test + run: npm test -- --ci --maxWorkers=2 + - name: Build run: npm run build diff --git a/README.md b/README.md index 4ffc8f9..82996db 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,16 @@
+
+
+