Skip to content

ci: support npm trusted publishers #733

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
CharlieC3 wants to merge 1 commit into from
Closed

ci: support npm trusted publishers #733

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 20 additions & 20 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jobs:
working-directory: ./components/chainhook-${{ matrix.suite }}
steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@v5
with:
persist-credentials: false

Expand Down Expand Up @@ -71,7 +71,7 @@ jobs:
cargo tarpaulin --skip-clean --out lcov --features ${{ matrix.features }} -- --test-threads=1

- name: Upload coverage reports to Codecov
uses: codecov/codecov-action@v4
uses: codecov/codecov-action@v5
env:
token: ${{ secrets.CODECOV_TOKEN }}
codecov_yml_path: .github/codecov.yml
Expand Down Expand Up @@ -117,7 +117,7 @@ jobs:
git config --global core.eol lf

- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@v5

- name: Install Rust toolchain
run: rustup toolchain install stable --profile minimal --target ${{ matrix.target }}
Expand Down Expand Up @@ -266,21 +266,22 @@ jobs:
# Separate uploads to prevent paths from being preserved
- name: Upload cargo artifacts (Linux)
if: matrix.os != 'windows-latest'
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v5
with:
name: chainhook-${{ env.SHORT_TARGET_NAME }}
path: chainhook-${{ env.SHORT_TARGET_NAME }}.tar.gz

- name: Upload cargo artifact (Windows)
if: matrix.os == 'windows-latest'
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v5
with:
name: chainhook-${{ env.SHORT_TARGET_NAME }}
path: chainhook-${{ env.SHORT_TARGET_NAME }}.msi

semantic-release:
permissions:
contents: write
id-token: write
issues: write
pull-requests: write
runs-on: ubuntu-latest
Expand All @@ -293,12 +294,12 @@ jobs:
steps:
- name: Generate release bot app token
id: generate_token
uses: actions/create-github-app-token@v1
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.HIROSYSTEMS_RELEASE_BOT_ID }}
private-key: ${{ secrets.HIROSYSTEMS_RELEASE_BOT_PEM }}

- uses: actions/checkout@v4
- uses: actions/checkout@v5
with:
persist-credentials: false

Expand All @@ -310,10 +311,10 @@ jobs:
GH_TOKEN: ${{ steps.generate_token.outputs.token }}

- name: Download pre-built dists
uses: actions/download-artifact@v4
uses: actions/download-artifact@v6

- name: Semantic Release
uses: cycjimmy/semantic-release-action@v4
uses: cycjimmy/semantic-release-action@9cc899c47e6841430bbaedb43de1560a568dfd16 # v5
id: semantic
# Only run on non-PR events or only PRs that aren't from forks
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
Expand All @@ -324,15 +325,14 @@ jobs:
GIT_AUTHOR_EMAIL: "${{ steps.bot-user-id.outputs.user-id }}+${{ steps.generate_token.outputs.app-slug }}[bot]@users.noreply.github.com"
GIT_COMMITTER_EMAIL: "${{ steps.bot-user-id.outputs.user-id }}+${{ steps.generate_token.outputs.app-slug }}[bot]@users.noreply.github.com"
with:
semantic_version: 19
extra_plugins: |
@semantic-release/changelog@6.0.3
@semantic-release/git@10.0.1
@semantic-release/exec@6.0.3
conventional-changelog-conventionalcommits@6.1.0
@semantic-release/exec@7.1.0
conventional-changelog-conventionalcommits@9.1.0

- name: Trigger pkg-version-bump workflow
uses: peter-evans/repository-dispatch@v1
uses: peter-evans/repository-dispatch@v4
if: steps.semantic.outputs.new_release_version != ''
with:
token: ${{ secrets.GITHUB_TOKEN }}
Expand All @@ -352,13 +352,13 @@ jobs:
artifact: chainhook-linux-x64-glibc
dockerfile: dockerfiles/components/chainhook-node.dockerfile
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v5
with:
persist-credentials: false

- name: Checkout tag
if: needs.semantic-release.outputs.new_release_version != ''
uses: actions/checkout@v4
uses: actions/checkout@v5
with:
persist-credentials: false
ref: ${{ needs.semantic-release.outputs.new_release_git_tag }}
Expand Down Expand Up @@ -386,15 +386,15 @@ jobs:
password: ${{ secrets.DOCKERHUB_PASSWORD }}

- name: Download pre-built dist
uses: actions/download-artifact@v4
uses: actions/download-artifact@v6
with:
name: ${{ matrix.artifact }}

- name: Untar pre-built dist
run: tar zxvf *.tar.gz

- name: Build/Push Image
uses: docker/build-push-action@v5
uses: docker/build-push-action@v6
id: docker_push
with:
context: .
Expand All @@ -420,7 +420,7 @@ jobs:
url: https://platform.dev.hiro.so/
steps:
- name: Checkout actions repo
uses: actions/checkout@v4
uses: actions/checkout@v5
with:
ref: main
token: ${{ secrets.GH_TOKEN }}
Expand Down Expand Up @@ -463,7 +463,7 @@ jobs:
url: https://platform.stg.hiro.so/
steps:
- name: Checkout actions repo
uses: actions/checkout@v4
uses: actions/checkout@v5
with:
ref: main
token: ${{ secrets.GH_TOKEN }}
Expand Down Expand Up @@ -513,7 +513,7 @@ jobs:
url: https://platform.hiro.so/
steps:
- name: Checkout actions repo
uses: actions/checkout@v4
uses: actions/checkout@v5
with:
ref: main
token: ${{ secrets.GH_TOKEN }}
Expand Down
16 changes: 16 additions & 0 deletions .releaserc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,20 @@
"preset": "conventionalcommits"
}
],
[
"@semantic-release/exec",
{
"execCwd": "components/client/typescript",
"prepareCmd": "npm ci"
}
],
Comment on lines +28 to +34
Copy link
Contributor Author

@CharlieC3 CharlieC3 Nov 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this package also need to be built to publish it? Not all packages do.

Copy link
Collaborator

@rafaelcr rafaelcr Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This client is actually not integrated into semantic release yet and we've had to do the publishing by hand. We won't be able to integrate it into this file as easily because it has a completely different version than the repo release package.

We're deprecating this repo very soon so I think we should just keep it as is for now, what do you think?

Copy link
Contributor Author

@CharlieC3 CharlieC3 Nov 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Keeping it as-is would be ok in that context. This effort is mostly to prevent CI from breaking from NPM removes all tokens in early December. If this release has not been integrated with CI, then there's nothing to break :)

Will close this one out.

[
"@semantic-release/npm",
{
"pkgRoot": "./components/client/typescript",
"npmPublish": true
}
],
[
"@semantic-release/exec",
{
Expand All @@ -38,6 +52,8 @@
{
"assets": [
"CHANGELOG.md",
"components/client/typescript/package.json",
"components/client/typescript/package-lock.json",
"components/chainhook-cli/Cargo.toml",
"components/chainhook-cli/Cargo.lock"
]
Expand Down
Loading