makecode-steami/.github/workflows/release.yml at main · steamicc/makecode-steami · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
name: Release
on:
    push:
        branches:
            - main
permissions:
    contents: read # for checkout

jobs:
    release:
        name: Release
        runs-on: ubuntu-latest
        container:
            image: letssteam/makecode-toolchain:latest
            options: --user 1001 --security-opt no-new-privileges
        permissions:
            contents: write # to be able to publish a GitHub release
            issues: write # to be able to comment on released issues
            pull-requests: write # to be able to comment on released pull requests
            id-token: write # to enable use of OIDC for npm provenance
        strategy:
            matrix:
                node-version: [20.x]
        steps:
            - name: 'Generate token'
              id: generate_token
              uses: tibdex/github-app-token@v2
              with:
                  app_id: ${{ secrets.RELEASE_APP_ID }}
                  private_key: ${{ secrets.RELEASE_APP_SECRET }}
            - name: Cache node modules
              id: cache-npm
              uses: actions/cache@v4
              env:
                  cache-name: cache-node-modules
              with:
                  path: ~/.npm
                  key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
                  restore-keys: |
                      ${{ runner.os }}-build-${{ env.cache-name }}-
                      ${{ runner.os }}-build-
                      ${{ runner.os }}-
            - name: Use Node.js ${{ matrix.node-version }}
              uses: actions/setup-node@v4
              with:
                  node-version: ${{ matrix.node-version }}
            - uses: actions/checkout@v4
              with:
                token: ${{ steps.generate_token.outputs.token }}

            - run: npm run setup
            - run: npm run ci
            - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies
              run: npm audit signatures
            - name: Release
              env:
                GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
              run: npx semantic-release