Update sirbrillig/phpcs-variable-analysis requirement (#286) #26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - master | |
| concurrency: ${{ github.workflow }}-${{ github.ref }} | |
| permissions: {} | |
| jobs: | |
| release: | |
| name: Release npm packages | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # Push the "Version Packages" PR branch and create tags. | |
| pull-requests: write # Open/update the "Version Packages" PR. | |
| id-token: write # Required for npm Trusted Publishing (OIDC). | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| # Trusted Publishing requires Node >= 22.14.0; node-version 22 | |
| # resolves to the latest 22.x. | |
| node-version: '22' | |
| cache: npm | |
| # Trusted Publishing requires npm >= 11.5.1; Node 22 still ships npm 10. | |
| # Pinned for reproducible releases — bump intentionally. | |
| - name: Update npm | |
| run: npm install --global npm@11.18.0 | |
| - run: npm ci | |
| # When there are changesets, this opens/updates a "Version Packages" PR. | |
| # When that PR is merged (no changesets left), it runs the publish script. | |
| # | |
| # Publishing uses npm Trusted Publishing: no NPM_TOKEN is provided, so | |
| # changesets/action detects OIDC (ACTIONS_ID_TOKEN_REQUEST_* from | |
| # id-token: write) and skips writing an auth .npmrc — npm then authenticates | |
| # via the OIDC token and attaches build provenance automatically. Each | |
| # package must have a trusted publisher configured on npmjs.com (org: | |
| # wearerequired, repo: coding-standards, workflow: release.yml). | |
| - name: Create Release Pull Request or publish | |
| uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0 | |
| with: | |
| version: npm run version-packages | |
| publish: npm run release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # The PHP package `wearerequired/coding-standards` (repo root) is released | |
| # independently to Packagist by pushing a signed, bare-version git tag; see | |
| # CONTRIBUTING.md. Packagist syncs tags via its GitHub integration, so there | |
| # is no token- or OIDC-based publish step for it here. |