Skip to content

ci(release): gate npm publishing behind NPM_AUTOPUBLISH #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
liutingqiu merged 1 commit into from
Oct 23, 2026
Merged

ci(release): gate npm publishing behind NPM_AUTOPUBLISH #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,9 @@ jobs:

npm:
needs: release
# Automatic publishing stays off until the repository sets this variable
# together with a valid NPM_TOKEN. Manual `npm publish` works without it.
if: ${{ vars.NPM_AUTOPUBLISH == 'true' }}
runs-on: ubuntu-latest
permissions:
contents: read
Expand All @@ -88,8 +91,8 @@ jobs:
cache: npm
- run: npm ci
- run: npm run build
# Set an NPM_TOKEN repository secret to publish automatically. Without
# it the step is skipped and the tarball remains on the GitHub release.
# Automatic publishing also needs NPM_AUTOPUBLISH=true and a valid
# NPM_TOKEN secret. Otherwise publish the release tarball manually.
- name: publish to npm
if: ${{ env.NODE_AUTH_TOKEN != '' }}
run: npm publish --ignore-scripts --provenance --access public
6 changes: 3 additions & 3 deletions docs/RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,9 +43,9 @@ and `SHA256SUMS.txt`, packs the npm tarball, and optionally publishes to npm.
```

5. The workflow creates the GitHub release and uploads the host archive,
checksums and npm tarball. To publish to npm automatically, add an
`NPM_TOKEN` repository secret (`npm token create`); otherwise download the
tarball from the release and run `npm publish`.
checksums and npm tarball. To publish to npm automatically, set the
repository variable `NPM_AUTOPUBLISH` to `true` and add a valid `NPM_TOKEN`
repository secret; otherwise publish manually with `npm publish`.

6. Upload `assets/social-card.png` as the repository social preview in GitHub
settings if the card changed. GitHub has no API for that image.
Expand Down
Loading