mirror of
https://github.com/sbuffkin/hexmaker.git
synced 2026-07-22 14:30:24 +00:00
6c4ef36239
Attests build provenance via actions/attest-build-provenance@v2 for both release assets, addressing the Obsidian portal security recommendation. Requires id-token:write and attestations:write permissions (added). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
82 lines
2.4 KiB
YAML
82 lines
2.4 KiB
YAML
name: Release Obsidian plugin
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
attestations: write
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Read version from manifest
|
|
id: version
|
|
run: echo "version=$(node -p "require('./manifest.json').version")" >> $GITHUB_OUTPUT
|
|
|
|
- name: Check if release already exists
|
|
id: check
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
if gh release view "${{ steps.version.outputs.version }}" &>/dev/null; then
|
|
echo "exists=true" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "exists=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
if git ls-remote --tags origin "${{ steps.version.outputs.version }}" | grep -q .; then
|
|
echo "tag_exists=true" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "tag_exists=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Use Node.js
|
|
if: steps.check.outputs.exists == 'false'
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "lts/*"
|
|
cache: "npm"
|
|
|
|
- name: Install dependencies
|
|
if: steps.check.outputs.exists == 'false'
|
|
run: npm ci
|
|
|
|
- name: Run tests
|
|
if: steps.check.outputs.exists == 'false'
|
|
run: npm test
|
|
|
|
- name: Build plugin
|
|
if: steps.check.outputs.exists == 'false'
|
|
run: npm run build
|
|
|
|
- name: Attest build provenance
|
|
if: steps.check.outputs.exists == 'false'
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: |
|
|
main.js
|
|
styles.css
|
|
|
|
- name: Tag and create release
|
|
if: steps.check.outputs.exists == 'false'
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
version="${{ steps.version.outputs.version }}"
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
if [ "${{ steps.check.outputs.tag_exists }}" != "true" ]; then
|
|
git tag -a "$version" -m "$version"
|
|
git push origin "$version"
|
|
fi
|
|
gh release create "$version" \
|
|
--title="$version" \
|
|
--generate-notes \
|
|
main.js manifest.json styles.css
|