Skip to content
Publish

Publish #2

Sign in to view logs

Publish

Publish #2

Workflow file for this run

.github/workflows/publish.yml at eeb6665
name: Publish
on:
release:
types: [released]
jobs:
build-and-test:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up Node
uses: actions/setup-node@v4
with:
node-version: '22'
cache: yarn
- name: Install dependencies
run: yarn install --frozen-lockfile
- name: Build
run: yarn build
- name: Test
run: yarn test
bump-version:
needs: build-and-test
runs-on: ubuntu-latest
steps:
- name: Generate GitHub App token
id: generate-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ vars.CLI_GENERATION_APP_ID }}
private-key: ${{ secrets.CLI_GENERATION_APP_PRIVATE_KEY }}
- name: Check out repository code
uses: actions/checkout@v4
with:
token: ${{ steps.generate-token.outputs.token }}
- name: Set up Node
uses: actions/setup-node@v4
with:
node-version: '22'
- name: Install dependencies
run: |
yarn install --frozen-lockfile
npm i -g auto-changelog
- name: Bump version and add changelog
run: |
initialTag=${{ github.event.release.tag_name }}
tag="${initialTag//[v]/}"
echo $tag
git remote update
git fetch
git checkout --track origin/main
git config --global user.email "github-actions@github.com"
git config --global user.name "Github Actions"
npm --no-git-tag-version --allow-same-version version $tag
auto-changelog
git add .
git commit -m "release $tag"
git push
- name: Move tag
run: |
TAG_NAME=${{ github.event.release.tag_name }}
echo $TAG_NAME
git tag --force $TAG_NAME
git push --force origin $TAG_NAME
pack-tarballs:
needs: bump-version
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
ref: main
fetch-depth: 0
- name: Set up Node
uses: actions/setup-node@v4
with:
node-version: '22'
cache: yarn
- name: Install dependencies
run: yarn install --frozen-lockfile
- name: Build
run: yarn build
- name: Pack tarballs
run: npx oclif pack tarballs
- name: Upload tarballs
uses: actions/upload-artifact@v4
with:
name: tarballs
path: dist/*.tar.*
retention-days: 7
pack-macos-arm64:
needs: bump-version
runs-on: macos-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
ref: main
fetch-depth: 0
- name: Set up Node
uses: actions/setup-node@v4
with:
node-version: '22'
cache: yarn
- name: Install dependencies
run: yarn install --frozen-lockfile
- name: Build
run: yarn build
- name: Pack macOS ARM64
run: npx oclif pack macos --targets darwin-arm64
- name: Upload macOS ARM64 installer
uses: actions/upload-artifact@v4
with:
name: macos-arm64
path: dist/macos/*.pkg
retention-days: 7
pack-macos-x64:
needs: bump-version
runs-on: macos-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
ref: main
fetch-depth: 0
- name: Set up Node
uses: actions/setup-node@v4
with:
node-version: '22'
cache: yarn
- name: Install dependencies
run: yarn install --frozen-lockfile
- name: Build
run: yarn build
- name: Pack macOS x64
run: npx oclif pack macos --targets darwin-x64
- name: Upload macOS x64 installer
uses: actions/upload-artifact@v4
with:
name: macos-x64
path: dist/macos/*.pkg
retention-days: 7
pack-windows:
needs: bump-version
runs-on: windows-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
ref: main
fetch-depth: 0
- name: Set up Node
uses: actions/setup-node@v4
with:
node-version: '22'
cache: yarn
- name: Install dependencies
run: yarn install --frozen-lockfile
- name: Build
run: yarn build
- name: Pack Windows
run: npx oclif pack win
- name: Upload Windows installer
uses: actions/upload-artifact@v4
with:
name: windows
path: dist/win32/*.exe
retention-days: 7
publish:
needs: bump-version
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
steps:
- name: Check out repository code
uses: actions/checkout@v4
with:
ref: main
fetch-depth: 0
- name: Set up Node
uses: actions/setup-node@v4
with:
node-version: '22'
registry-url: 'https://registry.npmjs.org'
cache: yarn
- name: Ensure npm 11.5.1+
run: npm install -g npm@^11
- name: Install dependencies
run: yarn install --frozen-lockfile
- name: Build
run: yarn build
- name: Publish package
run: npm publish --access public
# No NODE_AUTH_TOKEN needed - OIDC handles authentication
publish-to-private-registry:
needs: publish
runs-on: ubuntu-latest
steps:
- name: Check out repository code
uses: actions/checkout@v4
with:
ref: main
fetch-depth: 0
- name: Set up Node for dependency installation
uses: actions/setup-node@v4
with:
node-version: '22'
registry-url: 'https://registry.npmjs.org'
cache: yarn
- name: Install dependencies
run: yarn install --frozen-lockfile
- name: Set up Node for private registry publishing
uses: actions/setup-node@v4
with:
node-version: '22'
registry-url: ${{ secrets.PRIVATE_NPM_REGISTRY_URL }}
- name: Build
run: yarn build
- name: Publish package to private registry
run: npm publish
env:
NODE_AUTH_TOKEN: ${{ secrets.PRIVATE_NPM_REGISTRY_TOKEN }}
SKIP_POSTVERSION: true
upload-release-assets:
needs: [pack-tarballs, pack-macos-arm64, pack-macos-x64, pack-windows]
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- name: Download tarballs
uses: actions/download-artifact@v4
with:
name: tarballs
path: dist/tarballs
- name: Download macOS ARM64
uses: actions/download-artifact@v4
with:
name: macos-arm64
path: dist/macos-arm64
- name: Download macOS x64
uses: actions/download-artifact@v4
with:
name: macos-x64
path: dist/macos-x64
- name: Download Windows
uses: actions/download-artifact@v4
with:
name: windows
path: dist/windows
- name: Upload assets to GitHub release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_REPO: ${{ github.repository }}
run: |
TAG=${{ github.event.release.tag_name }}
echo "Uploading assets to release $TAG..."
for file in dist/tarballs/* dist/macos-arm64/* dist/macos-x64/* dist/windows/*; do
[ -f "$file" ] || continue
echo "Uploading $(basename "$file")..."
gh release upload "$TAG" "$file" --repo "$GH_REPO" --clobber
done
echo "All assets uploaded successfully!"
update-homebrew:
needs: upload-release-assets
runs-on: ubuntu-latest
steps:
- name: Generate GitHub App token
id: generate-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ vars.CLI_GENERATION_APP_ID }}
private-key: ${{ secrets.CLI_GENERATION_APP_PRIVATE_KEY }}
owner: fireblocks
- name: Download tarballs
uses: actions/download-artifact@v4
with:
name: tarballs
path: dist/tarballs
- name: Update Homebrew formula
env:
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
run: |
TAG=${{ github.event.release.tag_name }}
VERSION="${TAG#v}"
ARM64_FILE=$(ls dist/tarballs/*darwin-arm64*.tar.gz | head -1)
X64_FILE=$(ls dist/tarballs/*darwin-x64*.tar.gz | head -1)
ARM64_SHA256=$(sha256sum "$ARM64_FILE" | awk '{print $1}')
X64_SHA256=$(sha256sum "$X64_FILE" | awk '{print $1}')
BASE_URL="https://github.com/fireblocks/fireblocks-cli/releases/download/${TAG}"
ARM64_FILENAME=$(basename "$ARM64_FILE")
X64_FILENAME=$(basename "$X64_FILE")
git clone "https://x-access-token:${GH_TOKEN}@github.com/fireblocks/homebrew-fireblocks-cli.git" tap
cd tap
git config user.email "github-actions@github.com"
git config user.name "GitHub Actions"
mkdir -p Formula
cat > Formula/fireblocks-cli.rb << FORMULA
class FireblocksCli < Formula
desc "Agent-first CLI for Fireblocks infrastructure"
homepage "https://github.com/fireblocks/fireblocks-cli"
version "${VERSION}"
license "MIT"
on_macos do
if Hardware::CPU.arm?
url "${BASE_URL}/${ARM64_FILENAME}"
sha256 "${ARM64_SHA256}"
else
url "${BASE_URL}/${X64_FILENAME}"
sha256 "${X64_SHA256}"
end
end
def install
libexec.install Dir["*"]
bin.write_exec_script libexec/"bin/fireblocks"
end
test do
assert_match version.to_s, shell_output("#{bin}/fireblocks --version")
end
end
FORMULA
git add Formula/fireblocks-cli.rb
git commit -m "Update fireblocks-cli to ${VERSION}"
git push