Repository navigation
fix linting #26
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Any Commit | |
| # Publishes preview packages via pkg.pr.new. Gated so untrusted/fork PRs can't | |
| # trigger a build+publish just by opening a PR - only: | |
| # - push: pushing to a branch already requires repo write access | |
| # - pull_request: only when opened/updated by an author with write access | |
| # (e.g. a maintainer's own branch) | |
| # - pull_request_review: for everyone else, once a maintainer approves the PR | |
| # tags/releases are excluded so version-tag pushes don't trigger a duplicate publish. | |
| on: | |
| push: | |
| branches: ['**'] | |
| tags: ['!**'] | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| pull_request_review: | |
| types: [submitted] | |
| permissions: {} | |
| jobs: | |
| check: | |
| name: Check permissions | |
| if: github.event_name == 'push' || github.event_name == 'pull_request' || github.event.review.state == 'approved' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: read | |
| outputs: | |
| approved: ${{ steps.check.outputs.approved }} | |
| steps: | |
| - name: Push events are already gated by branch write access | |
| if: github.event_name == 'push' | |
| id: push-approved | |
| run: echo "approved=true" >> "$GITHUB_OUTPUT" | |
| - name: Check PR author permission | |
| uses: actions-cool/check-user-permission@c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e # v2.4.0 | |
| if: github.event_name == 'pull_request' | |
| id: checkAuthor | |
| with: | |
| username: ${{ github.event.pull_request.user.login }} | |
| require: write | |
| - name: Check reviewer permission | |
| uses: actions-cool/check-user-permission@c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e # v2.4.0 | |
| if: github.event_name == 'pull_request_review' | |
| id: checkPermissions | |
| with: | |
| require: write | |
| - name: Combine results | |
| id: check | |
| # Exactly one of the three steps above runs per trigger, the others are | |
| # skipped and their outputs are empty strings, so this picks whichever ran. | |
| run: echo "approved=${{ steps.push-approved.outputs.approved || steps.checkAuthor.outputs.require-result || steps.checkPermissions.outputs.require-result }}" >> "$GITHUB_OUTPUT" | |
| build: | |
| name: Build | |
| needs: check | |
| if: needs.check.outputs.approved == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| # For PR-related events this checks out the PR head commit (not a merge | |
| # commit with main), matching the sha pkg-pr-new publishes/comments with. | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm run build | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: dist | |
| path: dist/ | |
| publish: | |
| name: Publish | |
| needs: build | |
| runs-on: ubuntu-latest | |
| # Separate job from `build` so only this one - the one that actually needs | |
| # to comment on the PR - carries pull-requests: write. | |
| permissions: | |
| pull-requests: write | |
| steps: | |
| # For PR-related events this checks out the PR head commit (not a merge | |
| # commit with main), matching the sha pkg-pr-new publishes/comments with. | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile --ignore-scripts | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: dist | |
| path: dist/ | |
| # --commentWithSha uses the commit sha in install URLs/comments instead | |
| # of a PR number, and pnpm exec (not npx/dlx) runs the pinned devDependency. | |
| - run: pnpm exec pkg-pr-new publish --commentWithSha |