agent-commerce/.github/workflows/release.yml at master · devlab-group/agent-commerce · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
name: Release checks

on:
  push:
    tags: ['v*']
  workflow_dispatch:

permissions:
  contents: read

env:
  # Same pin as ci.yml and docker/chain.Dockerfile.
  FOUNDRY_VERSION: 'v1.7.1'

jobs:
  # The full CI suite — lint, typecheck, unit/integration, contracts, E2E, the
  # package job's clean-consumer installs, and the Docker build — run against
  # the exact commit being tagged. `prepublishOnly` covers build + verify + the
  # built-CLI smoke test, but not the tarball installs, so without this a tag
  # could ship a package that no consumer can install.
  ci:
    name: CI
    uses: ./.github/workflows/ci.yml

  audit:
    name: Dependency audit review
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '22'
          cache: npm
      - run: npm ci
      # Reported for human review. High/critical findings must be assessed and
      # documented before release; irrelevant transitive advisories do not
      # automatically block.
      - run: npm audit --audit-level high || true
      - run: npm audit --json > audit.json || true
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: dependency-audit
          path: audit.json

  fresh-clone:
    name: Fresh-clone quickstart smoke test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '22'
          cache: npm
      - uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
        with:
          # Pinned: the default is `nightly`, a mutable input to a suite this
          # project calls deterministic.
          version: ${{ env.FOUNDRY_VERSION }}
      - name: Quickstart exactly as documented in the README
        run: |
          npm ci
          # The README's own instruction for a user that is not uid 1000.
          # GitHub runners are uid 1001, so the checkout is owned by 1001 while
          # compose's `user:` default is 1000 — the chain-deploy step then
          # cannot write .deploy/local.json and the whole stack fails.
          export DOCKER_UID="$(id -u)" DOCKER_GID="$(id -g)"
          docker compose up -d --build
          npm run agent-commerce -- doctor --config config-demo.yaml
          npm run demo:agent
      - name: Compose logs on failure
        if: failure()
        run: docker compose logs
      - name: Tear down
        if: always()
        run: docker compose down -v

  publish:
    name: Publish to npm
    # Only a tag ships. A manual dispatch on a branch runs the checks above and
    # stops here.
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [ci, audit, fresh-clone]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Trusted publishing: npm exchanges this short-lived OIDC token for
      # publish rights. There is no NPM_TOKEN in this repository, and nothing
      # here should ever add one — a long-lived token is the thing trusted
      # publishing exists to remove. Configure the publisher on npmjs.com
      # against this repository AND this workflow filename (release.yml); the
      # claim is checked against both, so renaming this file breaks publishing
      # until the setting is updated.
      id-token: write
    steps:
      # Every action below runs inside a job holding `id-token: write`, so a
      # moving tag here is a publish credential: whoever can repoint
      # `actions/checkout@v4` can mint an npm token for this package. Actions
      # are pinned by commit SHA — the trailing comment is the human-readable
      # version, the SHA is what GitHub resolves.
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '22'
          cache: npm
          registry-url: 'https://registry.npmjs.org'
      # `prepublishOnly` runs the full `npm run verify`, and part of that suite
      # spawns a real Anvil. Without Foundry here the publish fails on a test
      # that has nothing to do with the artifact being published.
      - uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
        with:
          # Pinned: the default is `nightly`, a mutable input to a suite this
          # project calls deterministic.
          version: ${{ env.FOUNDRY_VERSION }}
      # setup-node pairs Node 22 with npm 10, which predates trusted
      # publishing (needs >= 11.5.1). Without this the publish fails asking for
      # credentials that deliberately do not exist.
      #
      # Exact version, not `@latest`: this npm is the process that mints the
      # OIDC claim and uploads the tarball, so letting it float means the
      # publish path changes under an unrelated release with nothing in this
      # repository recording it.
      - run: npm install -g npm@11.6.2
      - run: npm ci
      - name: Publish
        run: npm publish --tag latest