1name: npm promote
2on:
3 schedule:
4 - cron: "*/10 * * * *"
5 workflow_run:
6 workflows: [Release]
7 types: [completed]
8 branches: [main]
9 workflow_dispatch:
10 inputs:
11 dry-run:
12 description: Print what would change without moving dist-tags or touching issues
13 type: boolean
14 default: false
15
16# Promotions never overlap. A running promotion is never cancelled; a newer
17# queued run replaces an older queued one, which is safe because every run
18# re-reads the registry.
19concurrency:
20 group: ${{ github.workflow }}
21 cancel-in-progress: false
22
23permissions: {}
24
25jobs:
26 promote:
27 name: Promote
28 # NPM_PROMOTE_PAUSED is the kill switch for a bad release still on `staging`.
29 if: >-
30 github.repository_owner == 'Effect-Ts'
31 && github.ref == 'refs/heads/main'
32 && vars.NPM_PROMOTE_PAUSED != 'true'
33 runs-on: ubuntu-latest
34 timeout-minutes: 15
35 # The npm trusted publisher configuration for dist-tags pins this
36 # workflow file and environment.
37 environment: npm-promote
38 permissions:
39 contents: read
40 # Records website deploys, so a failed or interrupted deploy is retried.
41 deployments: write
42 # npm trusted publishing: dist-tag writes authenticate over OIDC.
43 id-token: write
44 issues: write
45 steps:
46 - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
47 with:
48 ref: main
49 # The overdue check reads the commit that bumped the version.
50 fetch-depth: 0
51 persist-credentials: false
52 - name: Install dependencies
53 uses: ./.github/actions/setup
54 - name: Upgrade npm for OIDC dist-tag support
55 run: npm install -g npm@^11.21.0
56 # Promotes the release, deploys the website for it and keeps the tracking issue up to date.
57 - name: Promote staged release
58 env:
59 DRY_RUN: ${{ inputs.dry-run }}
60 GITHUB_TOKEN: ${{ github.token }}
61 WEBSITE_DISPATCH_TOKEN: ${{ secrets.WEBSITE_DISPATCH_TOKEN }}
62 run: |
63 args=()
64 if [[ "$DRY_RUN" == "true" ]]; then
65 args+=(--dry-run)
66 fi
67 node packages/tools/npm-promote/src/bin.ts "${args[@]}"