mirror of
https://github.com/openclaw/lobster.git
synced 2026-08-14 00:48:09 +00:00
568 lines
22 KiB
YAML
568 lines
22 KiB
YAML
name: Lobster NPM Release
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: Release tag to publish (for example v2026.1.21, v2026.1.21-beta.1, or fallback v2026.1.21-1)
|
|
required: true
|
|
type: string
|
|
preflight_only:
|
|
description: Run validation/build only and skip the gated publish job
|
|
required: true
|
|
default: false
|
|
type: boolean
|
|
preflight_run_id:
|
|
description: Existing successful preflight workflow run id to promote without rebuilding
|
|
required: false
|
|
type: string
|
|
npm_dist_tag:
|
|
description: npm dist-tag to publish to for stable releases
|
|
required: true
|
|
default: beta
|
|
type: choice
|
|
options:
|
|
- beta
|
|
- latest
|
|
promote_beta_to_latest:
|
|
description: Skip publish and promote the stable version already on npm beta to latest
|
|
required: true
|
|
default: false
|
|
type: boolean
|
|
|
|
concurrency:
|
|
group: lobster-npm-release-${{ github.event_name == 'workflow_dispatch' && format('{0}-{1}-{2}', inputs.tag, inputs.npm_dist_tag, inputs.promote_beta_to_latest) || github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
NODE_VERSION: "24.x"
|
|
PNPM_VERSION: "9.15.9"
|
|
|
|
jobs:
|
|
preflight_lobster_npm:
|
|
if: ${{ inputs.preflight_only && !inputs.promote_beta_to_latest }}
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Validate tag input format
|
|
env:
|
|
RELEASE_TAG: ${{ inputs.tag }}
|
|
RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*((-beta\.[1-9][0-9]*)|(-[1-9][0-9]*))?$ ]]; then
|
|
echo "Invalid release tag format: ${RELEASE_TAG}"
|
|
exit 1
|
|
fi
|
|
if [[ "${RELEASE_TAG}" == *"-beta."* && "${RELEASE_NPM_DIST_TAG}" != "beta" ]]; then
|
|
echo "Beta prerelease tags must publish to npm dist-tag beta."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Forbid preflight artifact promotion on validation-only runs
|
|
if: ${{ inputs.preflight_run_id != '' }}
|
|
run: |
|
|
echo "preflight_run_id is only valid for real publish runs."
|
|
exit 1
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
ref: refs/tags/${{ inputs.tag }}
|
|
fetch-depth: 0
|
|
|
|
- name: Setup Node environment
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
check-latest: false
|
|
|
|
- name: Setup pnpm
|
|
run: |
|
|
set -euo pipefail
|
|
corepack enable
|
|
corepack prepare "pnpm@${PNPM_VERSION}" --activate
|
|
node -v
|
|
npm -v
|
|
pnpm -v
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Validate release tag and package metadata
|
|
env:
|
|
RELEASE_TAG: ${{ inputs.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
PACKAGE_NAME="$(node -p "require('./package.json').name")"
|
|
PACKAGE_VERSION="$(node -p "require('./package.json').version")"
|
|
EXPECTED_VERSION="${RELEASE_TAG#v}"
|
|
|
|
if [[ "${PACKAGE_VERSION}" != "${EXPECTED_VERSION}" ]]; then
|
|
echo "package.json version ${PACKAGE_VERSION} does not match release tag ${RELEASE_TAG}."
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "${PACKAGE_NAME}" != "@clawdbot/lobster" ]]; then
|
|
echo "Unexpected package name ${PACKAGE_NAME}; update the workflow if the publish target changes."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Validated ${PACKAGE_NAME}@${PACKAGE_VERSION}"
|
|
|
|
- name: Validate changelog entry for release version
|
|
env:
|
|
RELEASE_TAG: ${{ inputs.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
node - <<'NODE'
|
|
const fs = require('node:fs');
|
|
|
|
const releaseTag = process.env.RELEASE_TAG;
|
|
const releaseVersion = releaseTag?.startsWith('v') ? releaseTag.slice(1) : releaseTag;
|
|
if (!releaseVersion) {
|
|
console.error('RELEASE_TAG is required to validate CHANGELOG.md.');
|
|
process.exit(1);
|
|
}
|
|
const changelog = fs.readFileSync('CHANGELOG.md', 'utf8');
|
|
const lines = changelog.split(/\r?\n/);
|
|
const heading = `## ${releaseVersion}`;
|
|
const start = lines.findIndex((line) => line.trim() === heading);
|
|
|
|
if (start === -1) {
|
|
console.error(`CHANGELOG.md is missing a release section for ${releaseVersion}.`);
|
|
process.exit(1);
|
|
}
|
|
|
|
let hasBullet = false;
|
|
for (let idx = start + 1; idx < lines.length; idx += 1) {
|
|
const trimmed = lines[idx].trim();
|
|
if (trimmed.startsWith('## ')) break;
|
|
if (trimmed.startsWith('- ')) {
|
|
hasBullet = true;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!hasBullet) {
|
|
console.error(`CHANGELOG.md section ${heading} must contain at least one bullet item.`);
|
|
process.exit(1);
|
|
}
|
|
|
|
console.log(`Validated CHANGELOG.md section ${heading}`);
|
|
NODE
|
|
|
|
- name: Ensure version is not already published
|
|
env:
|
|
PREFLIGHT_ONLY: ${{ inputs.preflight_only }}
|
|
run: |
|
|
set -euo pipefail
|
|
PACKAGE_NAME="$(node -p "require('./package.json').name")"
|
|
PACKAGE_VERSION="$(node -p "require('./package.json').version")"
|
|
|
|
if npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" version >/dev/null 2>&1; then
|
|
if [[ "${PREFLIGHT_ONLY}" == "true" ]]; then
|
|
echo "${PACKAGE_NAME}@${PACKAGE_VERSION} is already published on npm; continuing because preflight_only=true."
|
|
exit 0
|
|
fi
|
|
echo "${PACKAGE_NAME}@${PACKAGE_VERSION} is already published on npm."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Publishing ${PACKAGE_NAME}@${PACKAGE_VERSION}"
|
|
|
|
- name: Lint
|
|
run: pnpm lint
|
|
|
|
- name: Build
|
|
run: pnpm build
|
|
|
|
- name: Test
|
|
run: pnpm test
|
|
|
|
- name: Pack prepared npm tarball
|
|
id: packed_tarball
|
|
env:
|
|
RELEASE_TAG: ${{ inputs.tag }}
|
|
RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
PACKAGE_NAME="$(node -p "require('./package.json').name")"
|
|
PACKAGE_VERSION="$(node -p "require('./package.json').version")"
|
|
PACK_JSON="$(npm pack --ignore-scripts --json)"
|
|
echo "$PACK_JSON"
|
|
PACK_PATH="$(printf '%s\n' "$PACK_JSON" | node -e 'const chunks=[]; process.stdin.on("data", (chunk) => chunks.push(chunk)); process.stdin.on("end", () => { const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8")); const first = Array.isArray(parsed) ? parsed[0] : null; if (!first || typeof first.filename !== "string" || !first.filename) { process.exit(1); } process.stdout.write(first.filename); });')"
|
|
if [[ -z "$PACK_PATH" || ! -f "$PACK_PATH" ]]; then
|
|
echo "npm pack did not produce a tarball file." >&2
|
|
exit 1
|
|
fi
|
|
RELEASE_SHA="$(git rev-parse HEAD)"
|
|
ARTIFACT_DIR="$RUNNER_TEMP/lobster-npm-preflight"
|
|
rm -rf "$ARTIFACT_DIR"
|
|
mkdir -p "$ARTIFACT_DIR"
|
|
cp "$PACK_PATH" "$ARTIFACT_DIR/"
|
|
printf '%s\n' "$PACKAGE_NAME" > "$ARTIFACT_DIR/package-name.txt"
|
|
printf '%s\n' "$PACKAGE_VERSION" > "$ARTIFACT_DIR/package-version.txt"
|
|
printf '%s\n' "$RELEASE_TAG" > "$ARTIFACT_DIR/release-tag.txt"
|
|
printf '%s\n' "$RELEASE_SHA" > "$ARTIFACT_DIR/release-sha.txt"
|
|
printf '%s\n' "$RELEASE_NPM_DIST_TAG" > "$ARTIFACT_DIR/release-npm-dist-tag.txt"
|
|
echo "dir=$ARTIFACT_DIR" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Upload prepared npm publish bundle
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: lobster-npm-preflight-${{ inputs.tag }}
|
|
path: ${{ steps.packed_tarball.outputs.dir }}
|
|
if-no-files-found: error
|
|
|
|
validate_publish_request:
|
|
if: ${{ !inputs.preflight_only && !inputs.promote_beta_to_latest }}
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Require main workflow ref for publish
|
|
env:
|
|
WORKFLOW_REF: ${{ github.ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]]; then
|
|
echo "Real publish runs must be dispatched from main. Use preflight_only=true for branch validation."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Require preflight artifact promotion on real publish
|
|
env:
|
|
PREFLIGHT_RUN_ID: ${{ inputs.preflight_run_id }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ -z "${PREFLIGHT_RUN_ID}" ]]; then
|
|
echo "Real publish requires preflight_run_id from a successful npm preflight run." >&2
|
|
exit 1
|
|
fi
|
|
|
|
publish_lobster_npm:
|
|
needs: [validate_publish_request]
|
|
if: ${{ !inputs.preflight_only && !inputs.promote_beta_to_latest }}
|
|
runs-on: ubuntu-latest
|
|
environment: npm-release
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
id-token: write
|
|
steps:
|
|
- name: Validate tag input format
|
|
env:
|
|
RELEASE_TAG: ${{ inputs.tag }}
|
|
RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*((-beta\.[1-9][0-9]*)|(-[1-9][0-9]*))?$ ]]; then
|
|
echo "Invalid release tag format: ${RELEASE_TAG}"
|
|
exit 1
|
|
fi
|
|
if [[ "${RELEASE_TAG}" == *"-beta."* && "${RELEASE_NPM_DIST_TAG}" != "beta" ]]; then
|
|
echo "Beta prerelease tags must publish to npm dist-tag beta."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
ref: refs/tags/${{ inputs.tag }}
|
|
fetch-depth: 0
|
|
|
|
- name: Setup Node environment
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
check-latest: false
|
|
|
|
- name: Verify preflight run metadata
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PREFLIGHT_RUN_ID: ${{ inputs.preflight_run_id }}
|
|
run: |
|
|
set -euo pipefail
|
|
RUN_JSON="$(gh run view "$PREFLIGHT_RUN_ID" --repo "$GITHUB_REPOSITORY" --json workflowName,headBranch,event,conclusion,url)"
|
|
printf '%s' "$RUN_JSON" | node -e 'const fs = require("node:fs"); const run = JSON.parse(fs.readFileSync(0, "utf8")); const checks = [["workflowName", "Lobster NPM Release"], ["headBranch", "main"], ["event", "workflow_dispatch"], ["conclusion", "success"]]; for (const [key, expected] of checks) { if (run[key] !== expected) { console.error(`Referenced npm preflight run ${process.env.PREFLIGHT_RUN_ID} must have ${key}=${expected}, got ${run[key] ?? "<missing>"}.`); process.exit(1); } } console.log(`Using npm preflight run ${process.env.PREFLIGHT_RUN_ID}: ${run.url}`);'
|
|
|
|
- name: Download prepared npm tarball
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: lobster-npm-preflight-${{ inputs.tag }}
|
|
path: preflight-tarball
|
|
repository: ${{ github.repository }}
|
|
run-id: ${{ inputs.preflight_run_id }}
|
|
github-token: ${{ github.token }}
|
|
|
|
- name: Validate release tag and package metadata
|
|
env:
|
|
RELEASE_TAG: ${{ inputs.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
PACKAGE_NAME="$(node -p "require('./package.json').name")"
|
|
PACKAGE_VERSION="$(node -p "require('./package.json').version")"
|
|
EXPECTED_VERSION="${RELEASE_TAG#v}"
|
|
|
|
if [[ "${PACKAGE_VERSION}" != "${EXPECTED_VERSION}" ]]; then
|
|
echo "package.json version ${PACKAGE_VERSION} does not match release tag ${RELEASE_TAG}."
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "${PACKAGE_NAME}" != "@clawdbot/lobster" ]]; then
|
|
echo "Unexpected package name ${PACKAGE_NAME}; update the workflow if the publish target changes."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Validate changelog entry for release version
|
|
env:
|
|
RELEASE_TAG: ${{ inputs.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
node - <<'NODE'
|
|
const fs = require('node:fs');
|
|
|
|
const releaseTag = process.env.RELEASE_TAG;
|
|
const releaseVersion = releaseTag?.startsWith('v') ? releaseTag.slice(1) : releaseTag;
|
|
if (!releaseVersion) {
|
|
console.error('RELEASE_TAG is required to validate CHANGELOG.md.');
|
|
process.exit(1);
|
|
}
|
|
const changelog = fs.readFileSync('CHANGELOG.md', 'utf8');
|
|
const lines = changelog.split(/\r?\n/);
|
|
const heading = `## ${releaseVersion}`;
|
|
const start = lines.findIndex((line) => line.trim() === heading);
|
|
|
|
if (start === -1) {
|
|
console.error(`CHANGELOG.md is missing a release section for ${releaseVersion}.`);
|
|
process.exit(1);
|
|
}
|
|
|
|
let hasBullet = false;
|
|
for (let idx = start + 1; idx < lines.length; idx += 1) {
|
|
const trimmed = lines[idx].trim();
|
|
if (trimmed.startsWith('## ')) break;
|
|
if (trimmed.startsWith('- ')) {
|
|
hasBullet = true;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!hasBullet) {
|
|
console.error(`CHANGELOG.md section ${heading} must contain at least one bullet item.`);
|
|
process.exit(1);
|
|
}
|
|
|
|
console.log(`Validated CHANGELOG.md section ${heading}`);
|
|
NODE
|
|
|
|
- name: Ensure version is not already published
|
|
id: published_version
|
|
run: |
|
|
set -euo pipefail
|
|
PACKAGE_NAME="$(node -p "require('./package.json').name")"
|
|
PACKAGE_VERSION="$(node -p "require('./package.json').version")"
|
|
|
|
if npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" version >/dev/null 2>&1; then
|
|
echo "${PACKAGE_NAME}@${PACKAGE_VERSION} is already published on npm; skipping publish."
|
|
echo "already_published=true" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
echo "already_published=false" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Verify prepared tarball provenance
|
|
if: ${{ steps.published_version.outputs.already_published != 'true' }}
|
|
env:
|
|
RELEASE_TAG: ${{ inputs.tag }}
|
|
RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
EXPECTED_PACKAGE_NAME="$(node -p "require('./package.json').name")"
|
|
EXPECTED_PACKAGE_VERSION="$(node -p "require('./package.json').version")"
|
|
EXPECTED_RELEASE_SHA="$(git rev-parse HEAD)"
|
|
NAME_FILE="preflight-tarball/package-name.txt"
|
|
VERSION_FILE="preflight-tarball/package-version.txt"
|
|
TAG_FILE="preflight-tarball/release-tag.txt"
|
|
SHA_FILE="preflight-tarball/release-sha.txt"
|
|
NPM_DIST_TAG_FILE="preflight-tarball/release-npm-dist-tag.txt"
|
|
if [[ ! -f "$NAME_FILE" || ! -f "$VERSION_FILE" || ! -f "$TAG_FILE" || ! -f "$SHA_FILE" || ! -f "$NPM_DIST_TAG_FILE" ]]; then
|
|
echo "Prepared preflight metadata is missing." >&2
|
|
ls -la preflight-tarball >&2 || true
|
|
exit 1
|
|
fi
|
|
ARTIFACT_PACKAGE_NAME="$(tr -d '\r\n' < "$NAME_FILE")"
|
|
ARTIFACT_PACKAGE_VERSION="$(tr -d '\r\n' < "$VERSION_FILE")"
|
|
ARTIFACT_RELEASE_TAG="$(tr -d '\r\n' < "$TAG_FILE")"
|
|
ARTIFACT_RELEASE_SHA="$(tr -d '\r\n' < "$SHA_FILE")"
|
|
ARTIFACT_RELEASE_NPM_DIST_TAG="$(tr -d '\r\n' < "$NPM_DIST_TAG_FILE")"
|
|
if [[ "$ARTIFACT_PACKAGE_NAME" != "$EXPECTED_PACKAGE_NAME" ]]; then
|
|
echo "Prepared preflight package mismatch: expected $EXPECTED_PACKAGE_NAME, got $ARTIFACT_PACKAGE_NAME" >&2
|
|
exit 1
|
|
fi
|
|
if [[ "$ARTIFACT_PACKAGE_VERSION" != "$EXPECTED_PACKAGE_VERSION" ]]; then
|
|
echo "Prepared preflight version mismatch: expected $EXPECTED_PACKAGE_VERSION, got $ARTIFACT_PACKAGE_VERSION" >&2
|
|
exit 1
|
|
fi
|
|
if [[ "$ARTIFACT_RELEASE_TAG" != "$RELEASE_TAG" ]]; then
|
|
echo "Prepared preflight tag mismatch: expected $RELEASE_TAG, got $ARTIFACT_RELEASE_TAG" >&2
|
|
exit 1
|
|
fi
|
|
if [[ "$ARTIFACT_RELEASE_SHA" != "$EXPECTED_RELEASE_SHA" ]]; then
|
|
echo "Prepared preflight SHA mismatch: expected $EXPECTED_RELEASE_SHA, got $ARTIFACT_RELEASE_SHA" >&2
|
|
exit 1
|
|
fi
|
|
if [[ "$ARTIFACT_RELEASE_NPM_DIST_TAG" != "$RELEASE_NPM_DIST_TAG" ]]; then
|
|
echo "Prepared preflight npm dist-tag mismatch: expected $RELEASE_NPM_DIST_TAG, got $ARTIFACT_RELEASE_NPM_DIST_TAG" >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Resolve publish tarball
|
|
if: ${{ steps.published_version.outputs.already_published != 'true' }}
|
|
id: publish_tarball
|
|
run: |
|
|
set -euo pipefail
|
|
TARBALL_PATH="$(find preflight-tarball -type f -name '*.tgz' -print | sort | tail -n 1)"
|
|
if [[ -z "$TARBALL_PATH" ]]; then
|
|
echo "Prepared preflight tarball not found." >&2
|
|
ls -la preflight-tarball >&2 || true
|
|
exit 1
|
|
fi
|
|
echo "path=$TARBALL_PATH" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Publish
|
|
if: ${{ steps.published_version.outputs.already_published != 'true' }}
|
|
env:
|
|
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|
|
RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
printf '//registry.npmjs.org/:_authToken=%s\n' "$NODE_AUTH_TOKEN" > "$HOME/.npmrc"
|
|
npm whoami >/dev/null
|
|
publish_target="${{ steps.publish_tarball.outputs.path }}"
|
|
if [[ -n "${publish_target}" ]]; then
|
|
publish_target="./${publish_target}"
|
|
fi
|
|
npm publish "${publish_target}" --access public --tag "${RELEASE_NPM_DIST_TAG}" --provenance
|
|
|
|
promote_beta_to_latest:
|
|
if: ${{ inputs.promote_beta_to_latest }}
|
|
runs-on: ubuntu-latest
|
|
environment: npm-release
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Require main workflow ref for promotion
|
|
env:
|
|
WORKFLOW_REF: ${{ github.ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]]; then
|
|
echo "Promotion runs must be dispatched from main."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Validate promotion inputs
|
|
env:
|
|
PREFLIGHT_ONLY: ${{ inputs.preflight_only }}
|
|
PREFLIGHT_RUN_ID: ${{ inputs.preflight_run_id }}
|
|
RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ "${PREFLIGHT_ONLY}" == "true" ]]; then
|
|
echo "Promotion mode cannot run with preflight_only=true."
|
|
exit 1
|
|
fi
|
|
if [[ -n "${PREFLIGHT_RUN_ID}" ]]; then
|
|
echo "Promotion mode does not use preflight_run_id."
|
|
exit 1
|
|
fi
|
|
if [[ "${RELEASE_NPM_DIST_TAG}" != "beta" ]]; then
|
|
echo "Promotion mode expects npm_dist_tag=beta because it moves beta to latest without publishing."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Validate stable tag input format
|
|
env:
|
|
RELEASE_TAG: ${{ inputs.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*(-[1-9][0-9]*)?$ ]]; then
|
|
echo "Invalid stable release tag format: ${RELEASE_TAG}" >&2
|
|
exit 1
|
|
fi
|
|
echo "RELEASE_VERSION=${RELEASE_TAG#v}" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup Node environment
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
check-latest: false
|
|
|
|
- name: Validate npm dist-tags
|
|
env:
|
|
PACKAGE_NAME: "@clawdbot/lobster"
|
|
RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
|
|
run: |
|
|
set -euo pipefail
|
|
beta_version="$(npm view "${PACKAGE_NAME}" dist-tags.beta)"
|
|
latest_version="$(npm view "${PACKAGE_NAME}" dist-tags.latest)"
|
|
|
|
echo "Current beta dist-tag: ${beta_version}"
|
|
echo "Current latest dist-tag: ${latest_version}"
|
|
|
|
if [[ "${beta_version}" != "${RELEASE_VERSION}" ]]; then
|
|
echo "npm beta points at ${beta_version}, expected ${RELEASE_VERSION}." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! VERSION_A="${latest_version}" VERSION_B="${RELEASE_VERSION}" node <<'NODE'
|
|
function parseVersion(value) {
|
|
const match = /^([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9]+))?$/.exec(value);
|
|
if (!match) throw new Error(`Invalid version: ${value}`);
|
|
return {
|
|
major: Number(match[1]),
|
|
minor: Number(match[2]),
|
|
patch: Number(match[3]),
|
|
prerelease: match[4] === undefined ? null : Number(match[4]),
|
|
};
|
|
}
|
|
const latest = parseVersion(process.env.VERSION_A);
|
|
const release = parseVersion(process.env.VERSION_B);
|
|
const fields = ["major", "minor", "patch"];
|
|
for (const field of fields) {
|
|
if (latest[field] > release[field]) process.exit(1);
|
|
if (latest[field] < release[field]) process.exit(0);
|
|
}
|
|
if (latest.prerelease === null && release.prerelease !== null) process.exit(1);
|
|
if (latest.prerelease !== null && release.prerelease === null) process.exit(0);
|
|
if ((latest.prerelease ?? 0) > (release.prerelease ?? 0)) process.exit(1);
|
|
NODE
|
|
then
|
|
echo "npm latest ${latest_version} is newer than release ${RELEASE_VERSION}; refusing downgrade promotion." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! npm view "${PACKAGE_NAME}@${RELEASE_VERSION}" version >/dev/null 2>&1; then
|
|
echo "${PACKAGE_NAME}@${RELEASE_VERSION} is not published on npm." >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Promote beta to latest
|
|
env:
|
|
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|
|
PACKAGE_NAME: "@clawdbot/lobster"
|
|
RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
|
|
run: |
|
|
set -euo pipefail
|
|
printf '//registry.npmjs.org/:_authToken=%s\n' "$NODE_AUTH_TOKEN" > "$HOME/.npmrc"
|
|
npm whoami >/dev/null
|
|
npm dist-tag add "${PACKAGE_NAME}@${RELEASE_VERSION}" latest
|
|
promoted_latest="$(npm view "${PACKAGE_NAME}" dist-tags.latest)"
|
|
if [[ "${promoted_latest}" != "${RELEASE_VERSION}" ]]; then
|
|
echo "npm latest points at ${promoted_latest}, expected ${RELEASE_VERSION} after promotion." >&2
|
|
exit 1
|
|
fi
|
|
echo "Promoted ${PACKAGE_NAME}@${RELEASE_VERSION} from beta to latest."
|