Try out ODGen SAST scan using the odgen-action (#1770) #899
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| on: | |
| push: | |
| branches: | |
| - main | |
| permissions: read-all | |
| jobs: | |
| check: | |
| name: Check | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| released: ${{ steps.version.outputs.released }} | |
| release_notes: ${{ steps.version.outputs.release_notes }} | |
| version: ${{ steps.version.outputs.version }} | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| actions-results-receiver-production.githubapp.com:443 | |
| api.github.com:443 | |
| github.com:443 | |
| gitlab.com:443 | |
| nodejs.org:443 | |
| objects.githubusercontent.com:443 | |
| registry.npmjs.org:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 | |
| with: | |
| fetch-depth: 0 # To fetch all tags | |
| persist-credentials: false | |
| - name: Install Node.js | |
| uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 | |
| with: | |
| cache: npm | |
| node-version-file: .nvmrc | |
| - name: Install dependencies | |
| run: npm clean-install | |
| - name: Check if the current version is already released | |
| id: version | |
| run: | | |
| VERSION="v$(jq -r '.version' < package.json)" | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| if [ "$(git tag --list "$VERSION")" ]; then | |
| echo 'released=true' >> "$GITHUB_OUTPUT" | |
| else | |
| echo 'released=false' >> "$GITHUB_OUTPUT" | |
| { | |
| echo 'release_notes<<EOF' | |
| node script/release/get-release-notes.js | |
| echo 'EOF' | |
| } >> "$GITHUB_OUTPUT" | |
| fi | |
| git: | |
| name: git | |
| runs-on: ubuntu-24.04 | |
| if: ${{ needs.check.outputs.released == 'false' }} | |
| needs: | |
| - check | |
| permissions: | |
| contents: write # To push a ref | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| actions-results-receiver-production.githubapp.com:443 | |
| github.com:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 | |
| with: | |
| fetch-depth: 0 # To fetch all major version branches | |
| - name: Get release version | |
| uses: actions/github-script@e69ef5462fd455e02edcaf4dd7708eda96b9eda0 # v7.0.0 | |
| id: major_version | |
| env: | |
| VERSION: ${{ needs.check.outputs.version }} | |
| with: | |
| result-encoding: string | |
| script: | | |
| const version = `${process.env.VERSION}` | |
| const major = version.replace(/\.\d\.\d$/, "") | |
| return major | |
| - name: Create release tag | |
| env: | |
| VERSION: ${{ needs.check.outputs.version }} | |
| run: | | |
| git tag "${VERSION}" | |
| git push origin "${VERSION}" | |
| - name: Update major version branch | |
| env: | |
| MAJOR_VERSION: ${{ steps.major_version.outputs.result }} | |
| run: | | |
| git push origin "HEAD:${MAJOR_VERSION}" | |
| github: | |
| name: GitHub | |
| runs-on: ubuntu-24.04 | |
| if: ${{ needs.check.outputs.released == 'false' }} | |
| needs: | |
| - check | |
| - git | |
| permissions: | |
| contents: write # To create a GitHub Release | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| actions-results-receiver-production.githubapp.com:443 | |
| api.github.com:443 | |
| github.com:443 | |
| - name: Create GitHub release | |
| uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0 | |
| with: | |
| tag: ${{ needs.check.outputs.version }} | |
| name: Release ${{ needs.check.outputs.version }} | |
| body: ${{ needs.check.outputs.release_notes }} | |
| draft: false | |
| prerelease: false | |
| npm: | |
| name: npm | |
| runs-on: ubuntu-24.04 | |
| if: ${{ needs.check.outputs.released == 'false' }} | |
| permissions: | |
| id-token: write # To attach provenance to the published package | |
| environment: | |
| name: npm | |
| url: https://www.npmjs.com/package/shescape | |
| needs: | |
| - check | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| actions-results-receiver-production.githubapp.com:443 | |
| api.github.com:443 | |
| fulcio.sigstore.dev:443 | |
| github.com:443 | |
| gitlab.com:443 | |
| nodejs.org:443 | |
| objects.githubusercontent.com:443 | |
| registry.npmjs.org:443 | |
| rekor.sigstore.dev:443 | |
| sigstore-tuf-root.storage.googleapis.com:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Node.js | |
| uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 | |
| with: | |
| cache: npm | |
| node-version-file: .nvmrc | |
| registry-url: https://registry.npmjs.org | |
| - name: Install dependencies | |
| run: npm clean-install | |
| - name: Publish to npm | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| run: | | |
| npm run transpile | |
| npm publish --provenance |