Release #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| project: | |
| description: Package to release | |
| type: choice | |
| options: [angular, zone-js] | |
| default: angular | |
| version: | |
| description: Version specifier (e.g. 22.0.0, 22.0.0-rc.4, patch, minor) | |
| required: true | |
| dry-run: | |
| description: Dry run (preview only, no push/publish) | |
| type: boolean | |
| default: true | |
| concurrency: | |
| group: nx-release-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write # push release commit + tag, create GitHub release | |
| id-token: write # npm provenance / trusted publishing (OIDC) | |
| env: | |
| NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }} | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: ${{ inputs.dry-run && 'npm-publish-dry-run' || 'npm-publish' }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| # nx release needs tags + full history to build the changelog | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: lts/* | |
| cache: npm | |
| registry-url: https://registry.npmjs.org | |
| - name: Update npm (required for OIDC trusted publishing) | |
| run: | | |
| npm install -g npm@^11.5.1 | |
| npm --version | |
| - run: npm install --force | |
| - name: Configure git author | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| # Publishing is intentionally split out (--skip-publish) so the OIDC | |
| # token-clearing logic below wraps only the publish step. | |
| - name: nx release version + changelog | |
| run: > | |
| npx nx release ${{ inputs.version }} | |
| --groups=${{ inputs.project }} | |
| --skip-publish | |
| ${{ inputs.dry-run && '--dry-run' || '' }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Prereleases (e.g. 22.0.0-rc.4) publish to their prerelease dist-tag (rc), | |
| # never latest. In a dry run keyword specifiers (patch/minor) resolve from | |
| # the unbumped manifest, so the previewed tag may differ from a real run. | |
| - name: Resolve npm dist-tag | |
| id: dist-tag | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| spec='${{ inputs.version }}' | |
| if [[ "$spec" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-.+)?$ ]]; then | |
| version="$spec" | |
| else | |
| version=$(node -p "require('./packages/${{ inputs.project }}/package.json').version") | |
| fi | |
| if [[ "$version" == *-* ]]; then | |
| pre="${version#*-}" | |
| tag="${pre%%.*}" | |
| if [[ "$tag" =~ ^[0-9]+$ ]]; then | |
| tag="next" | |
| fi | |
| else | |
| tag="latest" | |
| fi | |
| echo "Resolved version ${version} -> dist-tag ${tag}" | |
| echo "tag=${tag}" >> "$GITHUB_OUTPUT" | |
| # OIDC trusted publishing (default): npm must find no token auth at all, | |
| # otherwise it uses the token instead of the OIDC exchange. | |
| - name: nx release publish (OIDC) | |
| if: ${{ vars.USE_NPM_TOKEN != 'true' }} | |
| shell: bash | |
| env: | |
| NPM_CONFIG_PROVENANCE: true | |
| NODE_AUTH_TOKEN: "" | |
| run: | | |
| set -euo pipefail | |
| unset NODE_AUTH_TOKEN | |
| rm -f ~/.npmrc || true | |
| if [[ -n "${NPM_CONFIG_USERCONFIG:-}" ]]; then | |
| rm -f "$NPM_CONFIG_USERCONFIG" || true | |
| fi | |
| npx nx release publish \ | |
| --groups=${{ inputs.project }} \ | |
| --tag "${{ steps.dist-tag.outputs.tag }}" \ | |
| --access public \ | |
| ${{ inputs.dry-run && '--dry-run' || '' }} | |
| # Token fallback: only when explicitly enabled via repo variable USE_NPM_TOKEN=true. | |
| - name: nx release publish (token) | |
| if: ${{ vars.USE_NPM_TOKEN == 'true' }} | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| NPM_CONFIG_PROVENANCE: true | |
| run: > | |
| npx nx release publish | |
| --groups=${{ inputs.project }} | |
| --tag "${{ steps.dist-tag.outputs.tag }}" | |
| --access public | |
| ${{ inputs.dry-run && '--dry-run' || '' }} |