build-and-test.yml

name: Build and Test

on:
  - push
  - pull_request

jobs:
  build:
    runs-on: ubuntu-latest

    env:
      MOZ_HEADLESS: 1
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
      - uses: actions/setup-node@v4
        with:
          node-version: "15"
      - uses: pnpm/action-setup@v4.0.0
        with:
          version: 5.17.3
      - run: pnpm install --frozen-lockfile
      - run: pnpm test
  publish:
    runs-on: ubuntu-latest
    env:
      # used by 'release-it'
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
      GITHUB_TOKEN: ${{ secrets.PUBLISH_BOT }}
      # used manually in setting git config
      BOT_EMAIL: ${{ secrets.PUBLISH_BOT_EMAIL }}
      # used by unit tests
      MOZ_HEADLESS: 1
    needs: build
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          # Use our own token instead of the default token
          # this step persists login credentials so strongly that we couldn't get them to override
          token: ${{ secrets.PUBLISH_BOT }}
      - uses: actions/setup-node@v4
        with:
          node-version: "15"
      - uses: pnpm/action-setup@v4.0.0
        with:
          version: 5.17.3
      - run: pnpm install --frozen-lockfile
      - name: Setup auth
        run: |
          git config --global user.email "$BOT_EMAIL"
          git config --global user.name "esm-bundle-org-bot"
          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > .npmrc
      - name: "Publish to npm"
        run: pnpm run release