From d952a5bb8fd9f21a38a20f06b3e22b54a81284e8 Mon Sep 17 00:00:00 2001 From: SashaMIT Date: Wed, 5 Aug 2026 20:20:25 +0700 Subject: [PATCH 1/3] ci: bind gnd-binary-build workflow inputs via env before shell Pass release_tag/dry_run (and related matrix values) through env: before release upload, download, version, and npm publish shell steps. Co-authored-by: Cursor --- .github/workflows/gnd-binary-build.yml | 42 +++++++++++++++++--------- 1 file changed, 28 insertions(+), 14 deletions(-) diff --git a/.github/workflows/gnd-binary-build.yml b/.github/workflows/gnd-binary-build.yml index 237de3342b5..f93e3ab94e7 100644 --- a/.github/workflows/gnd-binary-build.yml +++ b/.github/workflows/gnd-binary-build.yml @@ -158,9 +158,9 @@ jobs: run: ls -R artifacts - name: Upload Assets to Release + env: + VERSION: ${{ inputs.release_tag != '' && inputs.release_tag || github.ref_name }} run: | - VERSION="${{ inputs.release_tag != '' && inputs.release_tag || github.ref_name }}" - gh release upload $VERSION --clobber --repo $GITHUB_REPOSITORY \ artifacts/gnd-linux-x86_64/gnd-linux-x86_64.gz \ artifacts/gnd-linux-aarch64/gnd-linux-aarch64.gz \ @@ -215,16 +215,20 @@ jobs: - name: Download gnd binary env: GH_TOKEN: ${{ github.token }} + VERSION: ${{ inputs.release_tag != '' && inputs.release_tag || github.ref_name }} + MATRIX_ASSET: ${{ matrix.asset }} run: | - gh release download "${{ inputs.release_tag != '' && inputs.release_tag || github.ref_name }}" \ + gh release download "$VERSION" \ --repo "${{ github.repository }}" \ - --pattern "${{ matrix.asset }}" \ + --pattern "$MATRIX_ASSET" \ --output ./binary-archive - name: Extract binary + env: + MATRIX_EXTRACT: ${{ matrix.extract }} run: | mkdir -p pkg/bin - if [ "${{ matrix.extract }}" = "gunzip" ]; then + if [ "$MATRIX_EXTRACT" = "gunzip" ]; then gunzip -c ./binary-archive > pkg/bin/gnd chmod +x pkg/bin/gnd else @@ -235,8 +239,9 @@ jobs: - name: Determine version and npm tag id: version shell: bash + env: + VERSION: ${{ inputs.release_tag != '' && inputs.release_tag || github.ref_name }} run: | - VERSION="${{ inputs.release_tag != '' && inputs.release_tag || github.ref_name }}" VERSION="${VERSION#v}" echo "version=${VERSION}" >> $GITHUB_OUTPUT # Prerelease versions (e.g. 0.42.2-dev.1) need an explicit --tag @@ -251,8 +256,13 @@ jobs: - name: Create package.json shell: bash + env: + MATRIX_OS_FIELD: ${{ matrix.os_field }} + MATRIX_PLATFORM: ${{ matrix.platform }} + MATRIX_CPU_FIELD: ${{ matrix.cpu_field }} + PKG_VERSION: ${{ steps.version.outputs.version }} run: | - if [ "${{ matrix.os_field }}" = "win32" ]; then + if [ "${MATRIX_OS_FIELD}" = "win32" ]; then BIN_PATH="./bin/gnd.exe" else BIN_PATH="./bin/gnd" @@ -260,11 +270,11 @@ jobs: cat > pkg/package.json << EOF { - "name": "@graphprotocol/gnd-${{ matrix.platform }}", - "version": "${{ steps.version.outputs.version }}", - "description": "gnd binary for ${{ matrix.platform }}", - "os": ["${{ matrix.os_field }}"], - "cpu": ["${{ matrix.cpu_field }}"], + "name": "@graphprotocol/gnd-${MATRIX_PLATFORM}", + "version": "${PKG_VERSION}", + "description": "gnd binary for ${MATRIX_PLATFORM}", + "os": ["${MATRIX_OS_FIELD}"], + "cpu": ["${MATRIX_CPU_FIELD}"], "bin": { "gnd": "${BIN_PATH}" }, @@ -281,7 +291,10 @@ jobs: EOF - name: Publish - run: npm publish --provenance --access public --tag ${{ steps.version.outputs.tag }} ${{ inputs.dry_run && '--dry-run' || '' }} + env: + DRY_RUN_FLAG: ${{ inputs.dry_run && '--dry-run' || '' }} + NPM_TAG: ${{ steps.version.outputs.tag }} + run: npm publish --provenance --access public --tag "$NPM_TAG" $DRY_RUN_FLAG working-directory: pkg publish-npm-wrapper: @@ -302,8 +315,9 @@ jobs: - name: Determine version and npm tag id: version shell: bash + env: + VERSION: ${{ inputs.release_tag != '' && inputs.release_tag || github.ref_name }} run: | - VERSION="${{ inputs.release_tag != '' && inputs.release_tag || github.ref_name }}" VERSION="${VERSION#v}" echo "version=${VERSION}" >> $GITHUB_OUTPUT if [[ "$VERSION" == *-* ]]; then From 9a2a357470a4bbcaa3ca92e369a416cebd428070 Mon Sep 17 00:00:00 2001 From: SashaMIT Date: Wed, 5 Aug 2026 20:20:42 +0700 Subject: [PATCH 2/3] ci: restore release upload token and bind npm publish dry-run via env Co-authored-by: Cursor --- .github/workflows/gnd-binary-build.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/gnd-binary-build.yml b/.github/workflows/gnd-binary-build.yml index f93e3ab94e7..b41cc68bd8b 100644 --- a/.github/workflows/gnd-binary-build.yml +++ b/.github/workflows/gnd-binary-build.yml @@ -160,8 +160,9 @@ jobs: - name: Upload Assets to Release env: VERSION: ${{ inputs.release_tag != '' && inputs.release_tag || github.ref_name }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | - gh release upload $VERSION --clobber --repo $GITHUB_REPOSITORY \ + gh release upload "$VERSION" --clobber --repo "$GITHUB_REPOSITORY" \ artifacts/gnd-linux-x86_64/gnd-linux-x86_64.gz \ artifacts/gnd-linux-aarch64/gnd-linux-aarch64.gz \ artifacts/gnd-macos-x86_64/gnd-macos-x86_64.gz \ From e60f751106e2bff1d72c3442c842f10dbd28b7e8 Mon Sep 17 00:00:00 2001 From: SashaMIT Date: Wed, 5 Aug 2026 20:21:02 +0700 Subject: [PATCH 3/3] ci: bind wrapper npm publish tag/dry-run via env before shell Co-authored-by: Cursor --- .github/workflows/gnd-binary-build.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/gnd-binary-build.yml b/.github/workflows/gnd-binary-build.yml index b41cc68bd8b..0951a3611ba 100644 --- a/.github/workflows/gnd-binary-build.yml +++ b/.github/workflows/gnd-binary-build.yml @@ -366,5 +366,8 @@ jobs: EOF - name: Publish - run: npm publish --provenance --access public --tag ${{ steps.version.outputs.tag }} ${{ inputs.dry_run && '--dry-run' || '' }} - working-directory: pkg \ No newline at end of file + env: + DRY_RUN_FLAG: ${{ inputs.dry_run && '--dry-run' || '' }} + NPM_TAG: ${{ steps.version.outputs.tag }} + run: npm publish --provenance --access public --tag "$NPM_TAG" $DRY_RUN_FLAG + working-directory: pkg