semantic-release.yml

# https://help.github.com/en/categories/automating-your-workflow-with-github-actions

name: "Semantic Release"

on: # yamllint disable-line rule:truthy
    push:
        branches:
            - "([0-9])?(.{+([0-9]),x}).x"
            - "main"
            - "next"
            - "next-major"
            - "alpha"
            - "beta"

permissions:
    contents: "read" # for checkout

jobs:
    semantic-release:
        name: "Semantic Release"
        runs-on: "ubuntu-latest"
        permissions:
            contents: "write" # to be able to publish a GitHub release
            issues: "write" # to be able to comment on released issues
            pull-requests: "write" # to be able to comment on released pull requests
            id-token: "write" # to enable use of OIDC for npm provenance

        steps:
            - name: "Harden Runner"
              uses: "step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895" # v2.6.1
              with:
                  egress-policy: "audit"

            - name: "Wait for tests to succeed"
              uses: "lewagon/wait-on-check-action@595dabb3acf442d47e29c9ec9ba44db0c6bdd18f" # v1.3.3
              timeout-minutes: 20
              with:
                  ref: "${{ github.event.pull_request.head.sha || github.sha }}"
                  repo-token: "${{ secrets.GITHUB_TOKEN }}"
                  wait-interval: 60 # seconds
                  running-workflow-name: "Semantic Release" # wait for all other checks to complete
                  allowed-conclusions: "success,skipped" # all other checks must pass, being skipped or cancelled is not sufficient

            - name: "Git checkout"
              uses: "actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11" # v4.1.1
              with:
                  fetch-depth: 0
                  persist-credentials: false
              env:
                  GIT_COMMITTER_NAME: "GitHub Actions Shell"
                  GIT_AUTHOR_NAME: "GitHub Actions Shell"
                  EMAIL: "github-actions[bot]@users.noreply.github.com"

            - uses: "pnpm/action-setup@d882d12c64e032187b2edb46d3a0d003b7a43598" # v2.4.0
              with:
                  version: 8
                  run_install: false

            - name: "Use Node.js 20.x"
              uses: "actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8" # v4.0.1
              with:
                  node-version: "20.6.1"
                  cache: "pnpm"

            # @see: npm install -g npm@latest is necessary to make provenance available. More info: https://docs.npmjs.com/generating-provenance-statements
            - name: "Upgrade npm to latest version"
              run: "npm install --global npm@9.6.x"
              env:
                  SKIP_CHECK: "true"

            - name: "Check npm version"
              run: "npm -v"
              env:
                  SKIP_CHECK: "true"

            - name: "Install packages"
              run: "pnpm install --frozen-lockfile"
              env:
                  SKIP_BUILD: "true"

            - name: "Verify the integrity of provenance attestations and registry signatures for installed dependencies"
              run: "npm audit signatures"

            - name: "Build Production"
              run: "pnpm run build:prod:packages"

            - name: "npm v8.5+ requires workspaces-update to be set to false"
              run: "echo 'workspaces-update=false' >> .npmrc"

            - name: "Semantic Release"
              if: "success()"
              env:
                  GITHUB_TOKEN: "${{ secrets.SEMANTIC_RELEASE_GITHUB_TOKEN }}"
                  NPM_TOKEN: "${{ secrets.NPM_AUTH_TOKEN }}"
                  GIT_AUTHOR_NAME: "github-actions-shell"
                  GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
                  GIT_COMMITTER_NAME: "github-actions-shell"
                  GIT_COMMITTER_EMAIL: "github-actions[bot]@users.noreply.github.com"
              run: "pnpm exec multi-semantic-release"

    pnpm-lock-update:
        needs: "semantic-release"
        name: "pnpm-lock.yaml update"
        runs-on: "ubuntu-latest"
        permissions:
            contents: "write" # to be able to publish
        steps:
            - name: "Harden Runner"
              uses: "step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895" # v2.6.1
              with:
                  egress-policy: "audit"

            - name: "Git checkout"
              uses: "actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11" # v4.1.1
              with:
                  fetch-depth: 2
              env:
                  GIT_COMMITTER_NAME: "GitHub Actions Shell"
                  GIT_AUTHOR_NAME: "GitHub Actions Shell"
                  EMAIL: "github-actions[bot]@users.noreply.github.com"

            - uses: "pnpm/action-setup@d882d12c64e032187b2edb46d3a0d003b7a43598" # v2.4.0
              with:
                  version: 8

            - name: "Use Node.js 20.x"
              uses: "actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8" # v4.0.1
              with:
                  node-version: "20.6.1"

            - name: "Update pnpm lock"
              run: "pnpm install --no-frozen-lockfile"
              env:
                  SKIP_BUILD: "true"

            - name: "Commit modified files"
              uses: "stefanzweifel/git-auto-commit-action@8756aa072ef5b4a080af5dc8fef36c5d586e521d" # v5.0.0
              with:
                  commit_message: "chore: updated pnpm-lock.yaml"
                  commit_author: "prisis <d.bannert@anolilab.de>"
                  commit_user_email: "d.bannert@anolilab.de"
                  commit_user_name: "prisis"
                  branch: "${{ github.head_ref }}"