npm-publish.yml

name: Publish Package to npm
on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to publish"
        required: true

permissions:
  contents: read

jobs:
  check-version:
    runs-on: ubuntu-latest
    outputs:
      is-new-version: ${{ steps.cpv.outputs.is-new-version }}
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.inputs.tag }}

      - name: Validate semver pattern
        run: npx semver ${{ inputs.tag }}

      - name: Check package version
        id: cpv
        uses: PostHog/check-package-version@v2

      - name: Validate package version
        uses: actions/github-script@v6
        with:
          script: |
            const isNewVersion = `${{ steps.cpv.outputs.is-new-version }}`;
            if (isNewVersion === 'true') {
                console.log(`Version ${context.payload.inputs.tag} has not been published yet`);
            } else {
                core.setFailed(`Version ${context.payload.inputs.tag} is already published`);
            }

  check-status:
    needs: check-version
    if: needs.check-version.outputs.is-new-version == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Verify checks passed
        uses: actions/github-script@v6
        with:
          result-encoding: string
          retries: 3
          script: |
            const script = require('./publish');
            console.log(await script({ github, context, core }));

  publish:
    needs: [check-status]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: step-security/harden-runner@v1
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            nodejs.org:443
            prod.api.stepsecurity.io:443
            registry.npmjs.org:443

      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.inputs.tag }}

      - uses: ljharb/actions/node/install@main
        name: "nvm install lts/* && npm install"
        with:
          node-version: "lts/*"
        env:
          NPM_CONFIG_LEGACY_PEER_DEPS: true

      - run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" >> .npmrc

      - run: npm publish --dry-run

      - uses: step-security/wait-for-secrets@v1
        id: wait-for-secrets
        with:
          slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
          secrets: |
            OTP:
              name: 'OTP to publish package'
              description: 'OTP from authenticator app'

      - run: npm publish --access public --otp ${{ steps.wait-for-secrets.outputs.OTP }}