Skip to content

Commit 78ab6b5

Browse files
mcousmcous
committed
feat: add explicit support for provenance
1 parent d475c33 commit 78ab6b5

17 files changed

+157
-49
lines changed

‎.github/workflows/ci-cd.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,11 @@ jobs:
193193
name: Publish
194194
runs-on: ubuntu-latest
195195
timeout-minutes: 10
196+
197+
permissions:
198+
contents: read
199+
id-token: write
200+
196201
needs:
197202
- test
198203
- build
@@ -202,6 +207,14 @@ jobs:
202207
- name: Checkout source
203208
uses: actions/checkout@v3
204209

210+
- name: Install Node.js ${{ matrix.node-version }}
211+
uses: actions/setup-node@v3
212+
with:
213+
node-version: "18"
214+
215+
- name: Install latest npm
216+
run: npm install -g npm
217+
205218
- name: Download publish artifact
206219
uses: actions/download-artifact@v3
207220
with:

‎README.md

+39-26
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,9 @@ The v1 to v2 upgrade brought a few notable **breaking changes**. To migrate, mak
4141

4242
- The `type` output is now an empty string instead of `none` when no release occurs
4343
```diff
44-
- - if: ${{ steps.publish.outputs.type != 'none' }}
45-
+ - if: ${{ steps.publish.outputs.type }}
46-
run: echo "Version changed!"
44+
- run: echo "Version changed!"
45+
- if: ${{ steps.publish.outputs.type != 'none' }}
46+
+ if: ${{ steps.publish.outputs.type }}
4747
```
4848
- The `check-version` and `greater-version-only` options have been removed and replaced with `strategy`.
4949
- Use `strategy: all` (default) to publish all versions that do not yet exist in the registry.
@@ -73,7 +73,9 @@ See the [change log][] for more details and other changes in the v2 release.
7373
To use the GitHub Action, you'll need to add it as a step in your [workflow file][]. By default, the only thing you need to do is set the `token` parameter to your [npm authentication token][].
7474

7575
```yaml
76-
on: push
76+
on:
77+
push:
78+
branches: main
7779

7880
jobs:
7981
publish:
@@ -82,7 +84,7 @@ jobs:
8284
- uses: actions/checkout@v3
8385
- uses: actions/setup-node@v3
8486
with:
85-
node-version: 18
87+
node-version: "18"
8688
- run: npm ci
8789
- run: npm test
8890
- uses: JS-DevTools/npm-publish@v2
@@ -97,15 +99,18 @@ jobs:
9799

98100
You can set any or all of the following input parameters using `with`:
99101

100-
| Name | Type | Default | Description |
101-
| ---------- | ---------------------- | ----------------------------- | ----------------------------------------------------------------------------- |
102-
| `token` | string | **required** | Authentication token to use with the configured registry. |
103-
| `registry` | string | `https://registry.npmjs.org/` | Registry URL to use. |
104-
| `package` | string | Current working directory | Path to a package directory, a `package.json`, or a packed `.tgz` to publish |
105-
| `tag` | string | `latest` | [Distribution tag][npm-tag] to publish to. |
106-
| `access` | `public`, `restricted` | [npm defaults][npm-access] | Whether the package should be publicly visible or restricted. |
107-
| `strategy` | `all`, `upgrade` | `all` | Use `all` to publish all unique versions, `upgrade` for only semver upgrades. |
108-
| `dry-run` | boolean | `false` | Run `npm publish` with the `--dry-run` flag to prevent publication. |
102+
| Name | Type | Default | Description |
103+
| ------------ | ---------------------- | -------------------------------- | ----------------------------------------------------------------------------- |
104+
| `token` | string | **required** | Authentication token to use with the configured registry. |
105+
| `registry` | string | `https://registry.npmjs.org/` \* | Registry URL to use. |
106+
| `package` | string | Current working directory | Path to a package directory, a `package.json`, or a packed `.tgz` to publish |
107+
| `tag` | string | `latest` \* | [Distribution tag][npm-tag] to publish to. |
108+
| `access` | `public`, `restricted` | [npm defaults][npm-access] \* | Whether the package should be publicly visible or restricted. |
109+
| `provenance` | boolean | `false` \* | Run `npm publish` with the `--provenance` flag to add provenance statements. |
110+
| `strategy` | `all`, `upgrade` | `all` | Use `all` to publish all unique versions, `upgrade` for only semver upgrades. |
111+
| `dry-run` | boolean | `false` | Run `npm publish` with the `--dry-run` flag to prevent publication. |
112+
113+
\* Default values for these options may be specified using `publishConfig` in `package.json`.
109114

110115
[npm-tag]: https://docs.npmjs.com/cli/v9/commands/npm-publish#tag
111116
[npm-access]: https://docs.npmjs.com/cli/v9/commands/npm-publish#access
@@ -135,6 +140,7 @@ steps:
135140
| `old-version` | string | Previously published version on `tag` or empty if no previous version on tag. |
136141
| `tag` | string | [Distribution tag][npm-tag] the package was published to. |
137142
| `access` | string | [Access level][npm-access] the package was published with, or `default` if scoped-package defaults were used. |
143+
| `registry` | string | Registry the package was published to. |
138144
| `dry-run` | boolean | Whether `npm publish` was run in "dry run" mode. |
139145

140146
[semver release type]: https://github.com/npm/node-semver#release_types
@@ -166,17 +172,20 @@ As shown in the example above, you should pass an options object to the `npmPubl
166172
import type { Options } from "@jsdevtools/npm-publish";
167173
```
168174

169-
| Name | Type | Default | Description |
170-
| -------------------- | ---------------------- | ----------------------------- | ----------------------------------------------------------------------------- |
171-
| `token` | string | **required** | Authentication token to use with the configured registry. |
172-
| `registry` | string, `URL` | `https://registry.npmjs.org/` | Registry URL to use. |
173-
| `package` | string | Current working directory | Path to a package directory, a `package.json`, or a packed `.tgz` to publish |
174-
| `tag` | string | `latest` | [Distribution tag][npm-tag] to publish to. |
175-
| `access` | `public`, `restricted` | [npm defaults][npm-access] | Whether the package should be publicly visible or restricted. |
176-
| `strategy` | `all`, `upgrade` | `all` | Use `all` to publish all unique versions, `upgrade` for only semver upgrades. |
177-
| `dryRun` | boolean | `false` | Run `npm publish` with the `--dry-run` flag to prevent publication. |
178-
| `logger` | object | `undefined` | Logging interface with `debug`, `info`, and `error` log methods. |
179-
| `temporaryDirectory` | string | `os.tmpdir()` | Temporary directory to hold a generated `.npmrc` file |
175+
| Name | Type | Default | Description |
176+
| -------------------- | ---------------------- | -------------------------------- | ----------------------------------------------------------------------------- |
177+
| `token` | string | **required** | Authentication token to use with the configured registry. |
178+
| `registry` | string, `URL` | `https://registry.npmjs.org/` \* | Registry URL to use. |
179+
| `package` | string | Current working directory | Path to a package directory, a `package.json`, or a packed `.tgz` to publish |
180+
| `tag` | string | `latest` \* | [Distribution tag][npm-tag] to publish to. |
181+
| `access` | `public`, `restricted` | [npm defaults][npm-access] \* | Whether the package should be publicly visible or restricted. |
182+
| `provenance` | boolean | `false` \* | Run `npm publish` with the `--provenance` flag to add provenance statements. |
183+
| `strategy` | `all`, `upgrade` | `all` | Use `all` to publish all unique versions, `upgrade` for only semver upgrades. |
184+
| `dryRun` | boolean | `false` | Run `npm publish` with the `--dry-run` flag to prevent publication. |
185+
| `logger` | object | `undefined` | Logging interface with `debug`, `info`, and `error` log methods. |
186+
| `temporaryDirectory` | string | `os.tmpdir()` | Temporary directory to hold a generated `.npmrc` file |
187+
188+
\* Default values for these options may be specified using `publishConfig` in `package.json`.
180189

181190
### Output
182191

@@ -195,6 +204,7 @@ import type { Results } from "@jsdevtools/npm-publish";
195204
| `oldVersion` | Optional string | Previously published version on `tag` or `undefined` if no previous version. |
196205
| `tag` | string | [Distribution tag][npm-tag] that the package was published to. |
197206
| `access` | Optional string | [Access level][npm-access] the package was published with, or `undefined` if scoped-package defaults were used. |
207+
| `registry` | `URL` | Registry the package was published to. |
198208
| `dryRun` | boolean | Whether `npm publish` was run in "dry run" mode. |
199209

200210
## Command Line Interface
@@ -243,7 +253,10 @@ Options:
243253
Defaults to "latest".
244254

245255
--access <access> Package access, may be "public" or "restricted".
246-
See documentation for details.
256+
See npm documentation for details.
257+
258+
--provenance Publish with provenance statements.
259+
See npm documentation for details.
247260

248261
--strategy <strategy> Publish strategy, may be "all" or "upgrade".
249262
Defaults to "all", see documentation for details.

‎action.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ inputs:
2929
or restricted to members of your NPM organization.
3030
required: false
3131

32+
provenance:
33+
description: Attach provenance statements when publishing.
34+
required: false
35+
3236
strategy:
3337
description: >
3438
Version check and release strategy.

‎dist/main.js

+20-8
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)