📦 npm publish #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 📦 npm publish | |
| # PRESET — seeded once from template/presets/ (onboarding or first cascade), | |
| # then repo-owned: customize what + how THIS repo publishes. The inlined | |
| # per-repo replacement for the socket-registry reusable publish workflow. | |
| # | |
| # Default flow: manual dispatch, DRY-RUN unless `publish: true`; publishes the | |
| # workspace's publishable packages via the fleet staged-publish script with | |
| # npm provenance (OIDC trusted publishing — id-token: write, no long-lived | |
| # npm token). | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| publish: | |
| description: 'Publish for real (false = dry-run, the default).' | |
| type: boolean | |
| default: false | |
| dist-tag: | |
| description: 'npm dist-tag to publish under.' | |
| type: string | |
| default: 'latest' | |
| permissions: | |
| contents: read | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # npm provenance / trusted publishing mints its OIDC token here. | |
| id-token: write | |
| env: | |
| # Socket Firewall + CLI auth for the sfw-wrapped setup + pnpm install — | |
| # sfw and socket-cli read SOCKET_API_KEY from the org-wide secret. | |
| SOCKET_API_KEY: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} | |
| steps: | |
| # First step must be the third-party actions/checkout (GitHub fetches it | |
| # independently) to populate the workspace so the LOCAL | |
| # ./.github/actions/* composite resolves; setup-and-install re-checks-out | |
| # at its own deeper default. | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (2026-05-15) | |
| with: | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - name: Setup + install | |
| uses: ./.github/actions/fleet/setup-and-install | |
| # Build dist/ before publishing — the staged-publish script imports the | |
| # package's own built output (`@socketsecurity/lib/stdio/prompts` self- | |
| # resolves to dist/), and `files` ships dist/, so the tarball needs it. | |
| - name: Build | |
| run: pnpm run build | |
| - name: Publish | |
| env: | |
| DIST_TAG: ${{ inputs.dist-tag }} | |
| run: node scripts/fleet/npm-publish.mts --staged --tag "$DIST_TAG" ${{ inputs.publish != true && '--dry-run' || '' }} |