Skip to content

Commit f87181f

Browse files
evanwevanw
authored
enable trusted publishing (#4319)
1 parent fdece95 commit f87181f

File tree

5 files changed

+207
-163
lines changed

5 files changed

+207
-163
lines changed

‎.github/workflows/publish.yml‎

Lines changed: 65 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
name: Publish
22

33
permissions:
4-
contents: read
4+
id-token: write
5+
contents: write
56

67
on:
7-
workflow_dispatch:
8+
push:
9+
branches:
10+
- main
11+
paths:
12+
- version.txt
813

914
jobs:
1015
publish:
@@ -13,17 +18,71 @@ jobs:
1318
- name: Checkout code
1419
uses: actions/checkout@v3
1520

16-
- name: Read go.version
21+
- name: Read version info
1722
run: |
1823
echo "GO_VERSION=$(cat go.version)" >> $GITHUB_ENV
24+
echo "ESBUILD_VERSION=$(cat version.txt)" >> $GITHUB_ENV
1925
20-
- name: Set up Go 1.x
26+
# This is here to fail quickly if the release already exists
27+
- name: Try to create the "v${{ env.ESBUILD_VERSION }}" tag
28+
run: |
29+
git fetch --tags
30+
git tag "$ESBUILD_VERSION"
31+
32+
- name: Extract the release notes
33+
run: |
34+
CHANGELOG=$(awk -v "ver=$ESBUILD_VERSION" '/^## / { if (p) { exit }; if ($2 == ver) { p=1; next} } p' CHANGELOG.md)
35+
echo "CHANGELOG<<EOF" >> $GITHUB_ENV
36+
echo "$CHANGELOG" >> $GITHUB_ENV
37+
echo "EOF" >> $GITHUB_ENV
38+
39+
# Make sure we'll be able to generate release notes later on below
40+
- name: Release notes must not be empty
41+
run: |
42+
test -n "$CHANGELOG"
43+
44+
- name: Set up Go ${{ env.GO_VERSION }}
2145
uses: actions/setup-go@v3
2246
with:
2347
go-version: ${{ env.GO_VERSION }}
24-
id: go
2548

2649
- name: Setup Node.js environment
2750
uses: actions/setup-node@v3
2851
with:
29-
node-version: 18
52+
node-version: 24
53+
54+
# This updates the version in all "package.json" files
55+
- name: Build for all platforms
56+
run: |
57+
make platform-all
58+
59+
# All "package.json" files should have been updated already by running "make platform-all" and committing the results
60+
- name: Reject uncommitted/untracked changes
61+
run: |
62+
git status --porcelain
63+
test -z "$(git status --porcelain)"
64+
65+
# Trusted publishing requires this specific version of npm
66+
- name: Install npm
67+
run: |
68+
npm install -g [email protected]
69+
70+
- name: Publish packages
71+
run: |
72+
make publish-all
73+
74+
- name: Push the tag to GitHub
75+
run: |
76+
git push origin tag "v$ESBUILD_VERSION"
77+
78+
# Only do this after publishing was successful
79+
- name: Create a GitHub Release
80+
uses: actions/create-release@v1
81+
env:
82+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
83+
with:
84+
tag_name: v${{ env.ESBUILD_VERSION }}
85+
release_name: v${{ env.ESBUILD_VERSION }}
86+
body: ${{ env.CHANGELOG }}
87+
draft: false
88+
prerelease: false

‎.github/workflows/release.yml‎

Lines changed: 0 additions & 34 deletions
This file was deleted.

‎CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
# Changelog
22

3+
## Unreleased
4+
5+
* Enable trusted publishing ([#4281](https://github.com/evanw/esbuild/issues/4281))
6+
7+
GitHub and npm are recommending that maintainers for packages such as esbuild switch to [trusted publishing](https://docs.npmjs.com/trusted-publishers). With this release, a VM on GitHub will now build and publish all of esbuild's packages to npm instead of me. In theory.
8+
9+
Unfortunately there isn't really a way to test that this works other than to do it live. So this release is that live test. Hopefully this release is uneventful and is exactly the same as the previous one (well, except for the green provenance attestation checkmark on npm that happens with trusted publishing).
10+
311
## 0.25.12
412

513
* Fix a minification regression with CSS media queries ([#4315](https://github.com/evanw/esbuild/issues/4315))

‎Makefile‎

Lines changed: 61 additions & 123 deletions
Original file line numberDiff line numberDiff line change
@@ -421,190 +421,128 @@ platform-deno: platform-wasm
421421
node scripts/esbuild.js ./esbuild --deno
422422

423423
publish-all: check-go-version
424-
@grep "## $(ESBUILD_VERSION)" CHANGELOG.md || (echo "Missing '## $(ESBUILD_VERSION)' in CHANGELOG.md (required for automatic release notes)" && false)
425-
@npm --version > /dev/null || (echo "The 'npm' command must be in your path to publish" && false)
426-
@echo "Checking for uncommitted/untracked changes..." && test -z "`git status --porcelain | grep -vE 'M (CHANGELOG\.md|version\.txt)'`" || \
427-
(echo "Refusing to publish with these uncommitted/untracked changes:" && \
428-
git status --porcelain | grep -vE 'M (CHANGELOG\.md|version\.txt)' && false)
429-
@echo "Checking for main branch..." && test main = "`git rev-parse --abbrev-ref HEAD`" || \
430-
(echo "Refusing to publish from non-main branch `git rev-parse --abbrev-ref HEAD`" && false)
431-
@echo "Checking for unpushed commits..." && git fetch
432-
@test "" = "`git cherry`" || (echo "Refusing to publish with unpushed commits" && false)
433-
434-
# Prebuild now to prime go's compile cache and avoid timing issues later
435-
@$(MAKE) --no-print-directory platform-all
436-
437-
# Commit now before publishing so git is clean for this: https://github.com/golang/go/issues/37475
438-
# Note: If this fails, then the version number was likely not incremented before running this command
439-
git commit -am "publish $(ESBUILD_VERSION) to npm"
440-
git tag "v$(ESBUILD_VERSION)"
441-
@test -z "`git status --porcelain`" || (echo "Aborting because git is somehow unclean after a commit" && false)
442-
443424
# Make sure the npm directory is pristine (including .gitignored files) since it will be published
444425
rm -fr npm && git checkout npm
445426

446-
@echo Enter one-time password:
447-
@read OTP && OTP="$$OTP" $(MAKE) --no-print-directory -j4 \
448-
publish-win32-x64 \
449-
publish-win32-ia32 \
450-
publish-win32-arm64 \
451-
publish-wasi-preview1
452-
453-
@echo Enter one-time password:
454-
@read OTP && OTP="$$OTP" $(MAKE) --no-print-directory -j4 \
455-
publish-freebsd-arm64 \
456-
publish-freebsd-x64 \
457-
publish-openbsd-arm64 \
458-
publish-openbsd-x64
459-
460-
@echo Enter one-time password:
461-
@read OTP && OTP="$$OTP" $(MAKE) --no-print-directory -j4 \
462-
publish-darwin-arm64 \
463-
publish-darwin-x64 \
464-
publish-netbsd-arm64 \
465-
publish-netbsd-x64
466-
467-
@echo Enter one-time password:
468-
@read OTP && OTP="$$OTP" $(MAKE) --no-print-directory -j4 \
469-
publish-android-x64 \
470-
publish-android-arm \
471-
publish-android-arm64 \
472-
publish-openharmony-arm64
473-
474-
@echo Enter one-time password:
475-
@read OTP && OTP="$$OTP" $(MAKE) --no-print-directory -j4 \
476-
publish-linux-x64 \
477-
publish-linux-ia32 \
478-
publish-linux-arm
479-
480-
@echo Enter one-time password:
481-
@read OTP && OTP="$$OTP" $(MAKE) --no-print-directory -j4 \
482-
publish-linux-arm64 \
483-
publish-linux-riscv64 \
484-
publish-linux-loong64 \
485-
publish-linux-mips64el
486-
487-
@echo Enter one-time password:
488-
@read OTP && OTP="$$OTP" $(MAKE) --no-print-directory -j4 \
489-
publish-aix-ppc64 \
490-
publish-linux-ppc64 \
491-
publish-linux-s390x \
492-
publish-sunos-x64
493-
494-
# Do these last to avoid race conditions
495-
@echo Enter one-time password:
496-
@read OTP && OTP="$$OTP" $(MAKE) --no-print-directory -j4 \
497-
publish-neutral \
498-
publish-deno \
499-
publish-wasm \
500-
publish-dl
501-
502-
git push origin main "v$(ESBUILD_VERSION)"
427+
# Publish all platform-dependent packages first
428+
@$(MAKE) --no-print-directory publish-aix-ppc64
429+
@$(MAKE) --no-print-directory publish-android-arm
430+
@$(MAKE) --no-print-directory publish-android-arm64
431+
@$(MAKE) --no-print-directory publish-android-x64
432+
@$(MAKE) --no-print-directory publish-darwin-arm64
433+
@$(MAKE) --no-print-directory publish-darwin-x64
434+
@$(MAKE) --no-print-directory publish-freebsd-arm64
435+
@$(MAKE) --no-print-directory publish-freebsd-x64
436+
@$(MAKE) --no-print-directory publish-linux-arm
437+
@$(MAKE) --no-print-directory publish-linux-arm64
438+
@$(MAKE) --no-print-directory publish-linux-ia32
439+
@$(MAKE) --no-print-directory publish-linux-loong64
440+
@$(MAKE) --no-print-directory publish-linux-mips64el
441+
@$(MAKE) --no-print-directory publish-linux-ppc64
442+
@$(MAKE) --no-print-directory publish-linux-riscv64
443+
@$(MAKE) --no-print-directory publish-linux-s390x
444+
@$(MAKE) --no-print-directory publish-linux-x64
445+
@$(MAKE) --no-print-directory publish-netbsd-arm64
446+
@$(MAKE) --no-print-directory publish-netbsd-x64
447+
@$(MAKE) --no-print-directory publish-openbsd-arm64
448+
@$(MAKE) --no-print-directory publish-openbsd-x64
449+
@$(MAKE) --no-print-directory publish-openharmony-arm64
450+
@$(MAKE) --no-print-directory publish-sunos-x64
451+
@$(MAKE) --no-print-directory publish-wasi-preview1
452+
@$(MAKE) --no-print-directory publish-win32-arm64
453+
@$(MAKE) --no-print-directory publish-win32-ia32
454+
@$(MAKE) --no-print-directory publish-win32-x64
455+
456+
# Publish platform-independent packages last to avoid race conditions
457+
@$(MAKE) --no-print-directory publish-neutral
458+
@$(MAKE) --no-print-directory publish-wasm
503459

504460
publish-win32-x64: platform-win32-x64
505-
test -n "$(OTP)" && cd npm/@esbuild/win32-x64 && npm publish --otp="$(OTP)"
461+
cd npm/@esbuild/win32-x64 && npm publish
506462

507463
publish-win32-ia32: platform-win32-ia32
508-
test -n "$(OTP)" && cd npm/@esbuild/win32-ia32 && npm publish --otp="$(OTP)"
464+
cd npm/@esbuild/win32-ia32 && npm publish
509465

510466
publish-win32-arm64: platform-win32-arm64
511-
test -n "$(OTP)" && cd npm/@esbuild/win32-arm64 && npm publish --otp="$(OTP)"
467+
cd npm/@esbuild/win32-arm64 && npm publish
512468

513469
publish-wasi-preview1: platform-wasi-preview1
514-
test -n "$(OTP)" && cd npm/@esbuild/wasi-preview1 && npm publish --otp="$(OTP)"
470+
cd npm/@esbuild/wasi-preview1 && npm publish
515471

516472
publish-aix-ppc64: platform-aix-ppc64
517-
test -n "$(OTP)" && cd npm/@esbuild/aix-ppc64 && npm publish --otp="$(OTP)"
473+
cd npm/@esbuild/aix-ppc64 && npm publish
518474

519475
publish-android-x64: platform-android-x64
520-
test -n "$(OTP)" && cd npm/@esbuild/android-x64 && npm publish --otp="$(OTP)"
476+
cd npm/@esbuild/android-x64 && npm publish
521477

522478
publish-android-arm: platform-android-arm
523-
test -n "$(OTP)" && cd npm/@esbuild/android-arm && npm publish --otp="$(OTP)"
479+
cd npm/@esbuild/android-arm && npm publish
524480

525481
publish-android-arm64: platform-android-arm64
526-
test -n "$(OTP)" && cd npm/@esbuild/android-arm64 && npm publish --otp="$(OTP)"
482+
cd npm/@esbuild/android-arm64 && npm publish
527483

528484
publish-darwin-x64: platform-darwin-x64
529-
test -n "$(OTP)" && cd npm/@esbuild/darwin-x64 && npm publish --otp="$(OTP)"
485+
cd npm/@esbuild/darwin-x64 && npm publish
530486

531487
publish-darwin-arm64: platform-darwin-arm64
532-
test -n "$(OTP)" && cd npm/@esbuild/darwin-arm64 && npm publish --otp="$(OTP)"
488+
cd npm/@esbuild/darwin-arm64 && npm publish
533489

534490
publish-freebsd-x64: platform-freebsd-x64
535-
test -n "$(OTP)" && cd npm/@esbuild/freebsd-x64 && npm publish --otp="$(OTP)"
491+
cd npm/@esbuild/freebsd-x64 && npm publish
536492

537493
publish-freebsd-arm64: platform-freebsd-arm64
538-
test -n "$(OTP)" && cd npm/@esbuild/freebsd-arm64 && npm publish --otp="$(OTP)"
494+
cd npm/@esbuild/freebsd-arm64 && npm publish
539495

540496
publish-netbsd-arm64: platform-netbsd-arm64
541-
test -n "$(OTP)" && cd npm/@esbuild/netbsd-arm64 && npm publish --otp="$(OTP)"
497+
cd npm/@esbuild/netbsd-arm64 && npm publish
542498

543499
publish-netbsd-x64: platform-netbsd-x64
544-
test -n "$(OTP)" && cd npm/@esbuild/netbsd-x64 && npm publish --otp="$(OTP)"
500+
cd npm/@esbuild/netbsd-x64 && npm publish
545501

546502
publish-openbsd-arm64: platform-openbsd-arm64
547-
test -n "$(OTP)" && cd npm/@esbuild/openbsd-arm64 && npm publish --otp="$(OTP)"
503+
cd npm/@esbuild/openbsd-arm64 && npm publish
548504

549505
publish-openbsd-x64: platform-openbsd-x64
550-
test -n "$(OTP)" && cd npm/@esbuild/openbsd-x64 && npm publish --otp="$(OTP)"
506+
cd npm/@esbuild/openbsd-x64 && npm publish
551507

552508
publish-openharmony-arm64: platform-openharmony-arm64
553-
test -n "$(OTP)" && cd npm/@esbuild/openharmony-arm64 && npm publish --otp="$(OTP)"
509+
cd npm/@esbuild/openharmony-arm64 && npm publish
554510

555511
publish-linux-x64: platform-linux-x64
556-
test -n "$(OTP)" && cd npm/@esbuild/linux-x64 && npm publish --otp="$(OTP)"
512+
cd npm/@esbuild/linux-x64 && npm publish
557513

558514
publish-linux-ia32: platform-linux-ia32
559-
test -n "$(OTP)" && cd npm/@esbuild/linux-ia32 && npm publish --otp="$(OTP)"
515+
cd npm/@esbuild/linux-ia32 && npm publish
560516

561517
publish-linux-arm: platform-linux-arm
562-
test -n "$(OTP)" && cd npm/@esbuild/linux-arm && npm publish --otp="$(OTP)"
518+
cd npm/@esbuild/linux-arm && npm publish
563519

564520
publish-linux-arm64: platform-linux-arm64
565-
test -n "$(OTP)" && cd npm/@esbuild/linux-arm64 && npm publish --otp="$(OTP)"
521+
cd npm/@esbuild/linux-arm64 && npm publish
566522

567523
publish-linux-loong64: platform-linux-loong64
568-
test -n "$(OTP)" && cd npm/@esbuild/linux-loong64 && npm publish --otp="$(OTP)"
524+
cd npm/@esbuild/linux-loong64 && npm publish
569525

570526
publish-linux-mips64el: platform-linux-mips64el
571-
test -n "$(OTP)" && cd npm/@esbuild/linux-mips64el && npm publish --otp="$(OTP)"
527+
cd npm/@esbuild/linux-mips64el && npm publish
572528

573529
publish-linux-ppc64: platform-linux-ppc64
574-
test -n "$(OTP)" && cd npm/@esbuild/linux-ppc64 && npm publish --otp="$(OTP)"
530+
cd npm/@esbuild/linux-ppc64 && npm publish
575531

576532
publish-linux-riscv64: platform-linux-riscv64
577-
test -n "$(OTP)" && cd npm/@esbuild/linux-riscv64 && npm publish --otp="$(OTP)"
533+
cd npm/@esbuild/linux-riscv64 && npm publish
578534

579535
publish-linux-s390x: platform-linux-s390x
580-
test -n "$(OTP)" && cd npm/@esbuild/linux-s390x && npm publish --otp="$(OTP)"
536+
cd npm/@esbuild/linux-s390x && npm publish
581537

582538
publish-sunos-x64: platform-sunos-x64
583-
test -n "$(OTP)" && cd npm/@esbuild/sunos-x64 && npm publish --otp="$(OTP)"
539+
cd npm/@esbuild/sunos-x64 && npm publish
584540

585541
publish-wasm: platform-wasm
586-
test -n "$(OTP)" && cd npm/esbuild-wasm && npm publish --otp="$(OTP)"
542+
cd npm/esbuild-wasm && npm publish
587543

588544
publish-neutral: platform-neutral
589-
test -n "$(OTP)" && cd npm/esbuild && npm publish --otp="$(OTP)"
590-
591-
publish-deno:
592-
test -d deno/.git || (rm -fr deno && git clone [email protected]:esbuild/deno-esbuild.git deno)
593-
cd deno && git fetch && git checkout main && git reset --hard origin/main
594-
@$(MAKE) --no-print-directory platform-deno
595-
cd deno && git add mod.js mod.d.ts wasm.js wasm.d.ts esbuild.wasm
596-
cd deno && git commit -m "publish $(ESBUILD_VERSION) to deno"
597-
cd deno && git tag "v$(ESBUILD_VERSION)"
598-
cd deno && git push origin main "v$(ESBUILD_VERSION)"
599-
600-
publish-dl:
601-
test -d www/.git || (rm -fr www && git clone [email protected]:esbuild/esbuild.github.io.git www)
602-
cd www && git fetch && git checkout gh-pages && git reset --hard origin/gh-pages
603-
cd www && cat ../dl.sh | sed 's/$$ESBUILD_VERSION/$(ESBUILD_VERSION)/' > dl/latest
604-
cd www && cat ../dl.sh | sed 's/$$ESBUILD_VERSION/$(ESBUILD_VERSION)/' > "dl/v$(ESBUILD_VERSION)"
605-
cd www && git add dl/latest "dl/v$(ESBUILD_VERSION)"
606-
cd www && git commit -m "publish download script for $(ESBUILD_VERSION)"
607-
cd www && git push origin gh-pages
545+
cd npm/esbuild && npm publish
608546

609547
validate-build:
610548
@test -n "$(TARGET)" || (echo "The environment variable TARGET must be provided" && false)

0 commit comments

Comments
 (0)