openapi-constructs/.github/workflows/deploy.yml at master · block65/openapi-constructs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
name: Deploy

on:
  workflow_dispatch: {}
  release:
    types: [published]

jobs:
  publish-npm:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 26
          registry-url: https://registry.npmjs.org/
          cache: "pnpm"

      # The package scripts call just, so it is needed before install
      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0

      - run: pnpm install --frozen-lockfile

      - run: just typecheck

      # the trusted publisher grants "npm stage publish", so this uploads for
      # review rather than going live. approve it with pnpm stage approve.
      # provenance is attached automatically when publishing over oidc
      - run: pnpm stage publish --access public --no-git-checks