mirror of
https://github.com/Unleash/unleash.git
synced 2026-09-10 06:05:47 +00:00
Paula Guijarro
9257bcbae8
Replace long-lived AWS credentials with GitHub OIDC when publishing static assets to S3
55 lines
1.6 KiB
YAML
55 lines
1.6 KiB
YAML
name: 'Publish to npm'
|
|
|
|
permissions:
|
|
id-token: write
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Which version number should we use for the release"
|
|
type: 'string'
|
|
required: true
|
|
workflow_call:
|
|
inputs:
|
|
version:
|
|
description: "Which version number should we use for the release"
|
|
type: 'string'
|
|
required: true
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
ref: v${{ inputs.version }} # tag that should be created by the caller workflow
|
|
- uses: pnpm/action-setup@v5
|
|
- name: Setup to npm
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: 22.x
|
|
registry-url: 'https://registry.npmjs.org'
|
|
cache: 'pnpm'
|
|
cache-dependency-path: pnpm-lock.yaml
|
|
- name: Make sure we have newest version of npm
|
|
run: npm install -g npm@~11.10.0
|
|
- name: Build
|
|
run: |
|
|
pnpm install --frozen-lockfile
|
|
- name: Publish to npm
|
|
env:
|
|
NPM_CONFIG_PROVENANCE: true
|
|
run: |
|
|
LATEST=$(npm show unleash-server version)
|
|
TAG=$(node scripts/npm-tag.js $LATEST)
|
|
npm publish --tag ${TAG:-latest}
|
|
- uses: aws-actions/configure-aws-credentials@v6
|
|
with:
|
|
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
|
|
role-to-assume: ${{ secrets.AWS_STATIC_ASSETS_ROLE_ARN }}
|
|
role-session-name: github-actions-unleash
|
|
- name: Publish static assets to S3
|
|
run: |
|
|
aws s3 cp frontend/build s3://getunleash-static/unleash/v${{ inputs.version }} --recursive
|