Switch from npm to pnpm #360
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| release: | |
| types: [published] | |
| permissions: {} | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| package-manager-cache: false | |
| - name: Setup mise | |
| uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4 | |
| with: | |
| install: false | |
| # Caching is off in this workflow only. zizmor's cache-poisoning | |
| # audit flags a restorable cache in a job that builds release | |
| # artifacts, which is also why the setup-node steps here set | |
| # package-manager-cache: false. | |
| cache: false | |
| # Install pnpm only, so mise's own node does not shadow the node above. | |
| - name: Install pnpm | |
| env: | |
| MISE_AUTO_INSTALL: 'false' | |
| run: | | |
| mise install github:pnpm/pnpm | |
| dirname "$(mise which pnpm)" >> "$GITHUB_PATH" | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm test | |
| - run: pnpm run lint | |
| - run: pnpm run build | |
| - run: pnpm run build:docs | |
| publish: | |
| needs: build | |
| if: github.event_name == 'release' && github.event.action == 'published' | |
| runs-on: ubuntu-latest | |
| environment: npm | |
| permissions: | |
| contents: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| # Node 24 is required here, not 22: publishing uses npm Trusted | |
| # Publishing (OIDC), which needs npm >= 11.5.1. Node 22 bundles npm | |
| # 10.9.8; Node 24 bundles npm 11.17.0. Keeping setup-node also preserves | |
| # the registry-url .npmrc setup that OIDC relies on. | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24 | |
| package-manager-cache: false | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Setup mise | |
| uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4 | |
| with: | |
| install: false | |
| # Caching is off in this workflow only. zizmor's cache-poisoning | |
| # audit flags a restorable cache in a job that builds release | |
| # artifacts, which is also why the setup-node steps here set | |
| # package-manager-cache: false. | |
| cache: false | |
| # Install pnpm only, so mise's own node does not shadow the node above. | |
| - name: Install pnpm | |
| env: | |
| MISE_AUTO_INSTALL: 'false' | |
| run: | | |
| mise install github:pnpm/pnpm | |
| dirname "$(mise which pnpm)" >> "$GITHUB_PATH" | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm run build | |
| # Deliberately npm, not pnpm. pnpm has no native OIDC implementation | |
| # (pnpm/pnpm#9812); it shells out to npm publish, which has been reported | |
| # to break trusted publishing. npm publish is safe in a pnpm-installed | |
| # tree: it packs only `files` and never reads a lockfile. Do not "fix" | |
| # this to `pnpm publish`. | |
| - run: npm publish --provenance | |
| - run: pnpm run build:docs | |
| - name: Deploy docs to gh-pages | |
| uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| publish_dir: ./docs |