Release #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Publishes @wdio/browserstack-service to npm via OIDC Trusted Publishing | |
| # (no long-lived NPM_TOKEN). One-time setup by an @wdio npm org admin on npmjs.com: | |
| # @wdio/browserstack-service -> Settings -> Trusted Publisher -> GitHub Actions | |
| # Organization/user: browserstack | |
| # Repository: wdio-browserstack-service | |
| # Workflow filename: release.yml | |
| # Environment: (leave empty) | |
| # Requires: PUBLIC repo (for provenance), npm >= 11.5.1, Node >= 22.14.0. | |
| # | |
| # The gRPC/protobuf client is generated inline at build time (buf generate); there is no | |
| # separate core package for this workflow to version or publish. | |
| # | |
| # Release model (publishing is MANUAL): | |
| # * push to main / v8 -> opens/updates the "Version Packages" PR only. NEVER publishes; | |
| # merging that PR does NOT publish either. | |
| # * Run workflow (publish) -> publishes the merged version to npm (main -> `latest`, | |
| # v8 -> `v8`) with git tag + GitHub release + provenance. | |
| # * Run workflow (canary) -> snapshot prerelease to the npm `canary` dist-tag. | |
| on: | |
| push: | |
| branches: | |
| - main # v9 line -> opens Version PR (publish target: dist-tag "latest") | |
| - v8 # v8 line -> opens Version PR (publish target: dist-tag "v8" via publishConfig.tag) | |
| workflow_dispatch: | |
| inputs: | |
| publish: | |
| description: 'Publish the merged version to npm (main -> `latest`, v8 -> `v8`). Merge the "Version Packages" PR first so there are no pending changesets.' | |
| type: boolean | |
| default: false | |
| canary: | |
| description: 'Publish a canary prerelease to the npm `canary` dist-tag (validates OIDC + provenance end-to-end; never touches `latest`). Requires at least one pending changeset.' | |
| type: boolean | |
| default: false | |
| # Never run main and v8 releases on top of each other. | |
| concurrency: release-${{ github.ref }} | |
| permissions: | |
| contents: write # commit the "Version Packages" PR + create git tags | |
| pull-requests: write # open the "Version Packages" PR | |
| id-token: write # OIDC for npm trusted publishing + provenance | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 # Changesets needs full history/tags | |
| - name: Setup Node | |
| # NOTE: intentionally NO `registry-url:` here. setup-node's registry-url writes | |
| # `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` into ~/.npmrc; with no | |
| # NODE_AUTH_TOKEN that becomes an empty token line that can shadow OIDC Trusted | |
| # Publishing at `npm publish` time. npm already defaults to registry.npmjs.org and | |
| # publishConfig.access=public handles the scoped publish, so the line isn't needed. | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: 22 # resolves to >= 22.14 on the runner (OIDC floor) | |
| cache: 'npm' | |
| # Trusted Publishing needs npm >= 11.5.1. Pin to the 11.x line so a future | |
| # npm major can never silently change publish behaviour. | |
| - name: Upgrade npm to an OIDC-capable version | |
| run: npm install -g npm@11 | |
| - name: Install | |
| run: npm ci | |
| - name: Build | |
| run: npm run build | |
| - name: Test | |
| run: npm test | |
| # Version PR (push to main / v8): run changesets in VERSION-ONLY mode — open or update the | |
| # "Version Packages" PR (version bump + CHANGELOG). This step NEVER publishes: with no | |
| # `publish:` input, once the Version PR is merged (a push with no pending changesets) the | |
| # action simply no-ops. Publishing is the separate, manual step below. | |
| - name: Open/update the "Version Packages" PR | |
| if: github.event_name == 'push' | |
| uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1 | |
| with: | |
| version: npm run version # changeset version — manages the Version PR only | |
| createGithubReleases: false | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Publish (manual, workflow_dispatch with publish=true): publish the already-versioned | |
| # package to npm — main -> `latest`, v8 -> `v8` (via publishConfig.tag) — with git tag, | |
| # GitHub release, and provenance, over the OIDC trusted publisher (no NPM_TOKEN). | |
| # Merge the "Version Packages" PR first: this publishes only when there are no pending | |
| # changesets. If any remain, the action safely opens/updates the Version PR instead. | |
| - name: Publish to npm | |
| if: github.event_name == 'workflow_dispatch' && inputs.publish | |
| uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1 | |
| with: | |
| publish: npm run release # changeset publish (honors publishConfig.tag per branch) | |
| createGithubReleases: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # No NPM_TOKEN: auth is OIDC via id-token: write above. | |
| NPM_CONFIG_PROVENANCE: 'true' | |
| # Canary (manual, workflow_dispatch with canary=true): snapshot-version the pending | |
| # changesets and publish a prerelease to the `canary` dist-tag via the SAME OIDC trusted | |
| # publisher. Validates OIDC + provenance end-to-end without touching `latest`. | |
| # snapshot.useCalculatedVersion=true in .changeset/config.json makes the version | |
| # <next>-canary-<datetime> (e.g. 9.30.0-canary-...). Requires >=1 pending changeset. | |
| - name: Canary publish to `canary` dist-tag | |
| if: github.event_name == 'workflow_dispatch' && inputs.canary | |
| run: | | |
| npx changeset version --snapshot canary | |
| npx changeset publish --no-git-tag --tag canary | |
| env: | |
| NPM_CONFIG_PROVENANCE: 'true' |