chore: migrate release pipeline to trusted publishing

.changeset/witty-flies-agree.md

@@ -0,0 +1,5 @@
+---
+"@alauda/ui": patch
+---
+
+chore: migrate npm publishing to trusted publishing and Node 22

.github/workflows/release.yml

@@ -4,32 +4,43 @@ on:
   push:
     branches:
       - master
+  pull_request:
+    branches:
+      - master
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Hotfix package version for prod, 5.7.0-prod-3.5-0 for example.
+        required: true
+
+permissions:
+  contents: write
+  id-token: write
 
 jobs:
   release:
     name: Release
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      id-token: write
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: yarn
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: yarn --frozen-lockfile
 
       - name: Create Release Pull Request or Publish to npm
+        if: github.event_name == 'push'
         id: changesets
         uses: changesets/action@v1
         with:
@@ -39,7 +50,25 @@ jobs:
           publish: yarn release
         env:
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Release beta
+        if: github.event_name == 'pull_request'
+        run: sh scripts/release.sh
+        env:
+          PUBLISH_VERSION: beta
+
+      - name: Set git info
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --local user.name "github-actions[bot]"
+
+      - name: Release prod
+        if: github.event_name == 'workflow_dispatch'
+        run: sh scripts/release.sh
+        env:
+          PUBLISH_VERSION: ${{ github.event.inputs.version }}
 
       - name: Sync Cnpm
+        if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && steps.changesets.outputs.published == 'true')
         run: npx cnpm sync @alauda/ui

.github/workflows/stories.yml

@@ -10,12 +10,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22.14.0
           cache: yarn
 
       - name: Install dependencies

.github/workflows/test.yml

@@ -8,12 +8,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22.14.0
           cache: yarn
 
       - name: Install Dependencies

.nvmrc

@@ -1 +1 @@
-20
+24

scripts/release.sh

@@ -1,15 +1,11 @@
 #!/bin/sh
 
+set -e
+
 PUBLISH_VERSION=$(node scripts/publish-version)
 PUBLISH_BRANCH=$(node scripts/publish-branch)
 NPM_TAG=$(node scripts/npm-tag)
 
-if [ "$NODE_AUTH_TOKEN" = "" ] && [ "$NPM_TOKEN" = "" ]; then
-  echo "NPM_TOKEN is not available on PR from forked repository!"
-  echo "If you're a member of Alauda, just checkout a new branch instead."
-  exit 0
-fi
-
 if [ "$NPM_TAG" = "latest" ]; then
   echo "Publish latest tag via this script is not permitted anymore."
   exit 1
@@ -26,4 +22,4 @@ if [ "$PUBLISH_BRANCH" != "" ]; then
   git push --follow-tags origin "$PUBLISH_BRANCH"
 fi
 
-npm publish ./release --tag "$NPM_TAG" --provenance --access public
+npm publish ./release --tag "$NPM_TAG" --access public