This is an automated email from the ASF dual-hosted git repository. nodece pushed a commit to branch release-workflow in repository https://gitbox.apache.org/repos/asf/casbin-node-extensions.git
commit 630d52844ac51f6a6e214fcb60ac43202613db40 Author: Zixuan Liu <[email protected]> AuthorDate: Mon Nov 2 20:47:26 2026 +0800 ci: release publish workflow with RC dry-run gating and post-VOTE publishing --- .github/workflows/release_publish.yml | 67 +++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) diff --git a/.github/workflows/release_publish.yml b/.github/workflows/release_publish.yml new file mode 100644 index 0000000..f0f3b49 --- /dev/null +++ b/.github/workflows/release_publish.yml @@ -0,0 +1,67 @@ +# ASF-aligned release flow: +# 1. changesets version PR bumps CHANGED packages only (partial release) +# 2. tag extensions-vX.Y.Z-rc.N (contains '-') -> dry-run publish only +# 3. [VOTE] on dev@casbin passes +# 4. tag extensions-vX.Y.Z + manually dispatch with publish=true +# Notes: +# - `changeset publish` publishes only packages whose version is ahead of +# the registry; private packages (data-permission) are always skipped +# - consider npm Trusted Publishing (OIDC) to drop the NPM_TOKEN secret; +# requires npm >= 11.5.1 on a node 20+ runner (as OpenDAL does) +name: Release Publish + +on: + push: + tags: + - "extensions-v*" + workflow_dispatch: + inputs: + dry_run: + description: "Rehearse the publish (no registry writes)" + required: true + type: boolean + default: false + publish: + description: "Publish changed packages (ONLY after a passed VOTE)" + required: true + type: boolean + default: false + +permissions: + contents: write + +jobs: + publish: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: 20 + registry-url: https://registry.npmjs.org + - run: corepack enable && corepack prepare [email protected] --activate + - run: pnpm install --frozen-lockfile + - run: pnpm --filter "./packages/**" --no-bail build + - name: Dry-run publish (RC tags or manual rehearsal) + if: >- + (github.event_name == 'workflow_dispatch' && inputs.dry_run) || + (startsWith(github.ref, 'refs/tags/extensions-v') && contains(github.ref, '-')) + run: pnpm changeset publish --dry-run + - name: Publish (final tag after VOTE, or manual dispatch) + if: >- + (github.event_name == 'workflow_dispatch' && inputs.publish) || + (startsWith(github.ref, 'refs/tags/extensions-v') && !contains(github.ref, '-')) + run: pnpm changeset publish + env: + NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + - name: GitHub release for the snapshot tag + if: startsWith(github.ref, 'refs/tags/extensions-v') && !contains(github.ref, '-') + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + TAG="${GITHUB_REF_NAME}" + gh release create "$TAG" --generate-notes \ + -t "casbin-node-extensions ${TAG#extensions-}" \ + -n "Snapshot release. See packages/*/CHANGELOG.md for per-package notes." \ + || echo "release already exists" --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
