Skip to content

ci: Publish release to GitHub after NPM #308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mrtenz merged 2 commits into from
Apr 17, 2026
Merged

ci: Publish release to GitHub after NPM #308

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d846379
Publish release to GitHub after NPM
Mrtenz Apr 17, 2026
ff690d0
Revert checkout and setup change
Mrtenz Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 24 additions & 8 deletions .github/workflows/publish-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,89 +10,89 @@
PUBLISH_DOCS_TOKEN:
required: true
jobs:
publish-release:
permissions:
contents: write
build:
name: Build
runs-on: ubuntu-latest
steps:
- name: Checkout and setup environment
uses: MetaMask/action-checkout-and-setup@v3
with:
is-high-risk-environment: true
ref: ${{ github.sha }}
- uses: MetaMask/action-publish-release@v3
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: yarn build
- name: Build
run: yarn build
- name: Upload build artifacts
uses: actions/upload-artifact@v7
with:
name: publish-release-artifacts-${{ github.sha }}
retention-days: 4
include-hidden-files: true
path: |
./dist
./node_modules/.yarn-state.yml

publish-npm-dry-run:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}
needs: publish-release
name: Publish to NPM (dry run)
needs: build
runs-on: ubuntu-latest
steps:
- name: Checkout and setup environment
uses: MetaMask/action-checkout-and-setup@v3
with:
is-high-risk-environment: true
ref: ${{ github.sha }}
- name: Restore build artifacts
uses: actions/download-artifact@v8
with:
name: publish-release-artifacts-${{ github.sha }}
- name: Dry Run Publish
# omit npm-token token to perform dry run publish
uses: MetaMask/action-npm-publish@v5
with:
slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
subteam: S042S7RE4AE # @metamask-npm-publishers
env:
SKIP_PREPACK: true

publish-npm:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}
name: Publish to NPM
needs: publish-npm-dry-run
runs-on: ubuntu-latest
environment: npm-publish
steps:
- name: Checkout and setup environment
uses: MetaMask/action-checkout-and-setup@v3
with:
is-high-risk-environment: true
ref: ${{ github.sha }}
- name: Restore build artifacts
uses: actions/download-artifact@v8
with:
name: publish-release-artifacts-${{ github.sha }}
- name: Publish
uses: MetaMask/action-npm-publish@v5
with:
# This `NPM_TOKEN` needs to be manually set per-repository.
# Look in the repository settings under "Environments", and set this token in the `npm-publish` environment.
npm-token: ${{ secrets.NPM_TOKEN }}
env:
SKIP_PREPACK: true

get-release-version:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}
name: Get release version
needs: publish-npm
runs-on: ubuntu-latest
outputs:
RELEASE_VERSION: ${{ steps.get-release-version.outputs.RELEASE_VERSION }}
steps:
- uses: actions/checkout@v6
with:
ref: ${{ github.sha }}
- id: get-release-version
shell: bash
run: ./scripts/get.sh ".version" "RELEASE_VERSION"

publish-release-to-gh-pages:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
name: Publish docs to `${{ needs.get-release-version.outputs.RELEASE_VERSION }}` directory of `gh-pages` branch
needs: get-release-version
permissions:
Expand All @@ -113,3 +113,19 @@
destination_dir: latest
secrets:
PUBLISH_DOCS_TOKEN: ${{ secrets.PUBLISH_DOCS_TOKEN }}

publish-release:
name: Publish to GitHub
needs: publish-npm
permissions:
contents: write
runs-on: ubuntu-latest
steps:
- name: Checkout and setup environment
Comment thread
Mrtenz marked this conversation as resolved.
uses: MetaMask/action-checkout-and-setup@v3
with:
is-high-risk-environment: true
ref: ${{ github.sha }}
- uses: MetaMask/action-publish-release@v3
Copy link
Copy Markdown
Contributor

@mcmire mcmire Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see that this now goes after the doc publishing steps. Does it make sense for the doc publishing to go afterward instead?

This action also creates a Git tag in addition to creating the GitHub release. Do you think that will create a problem if the tag gets created after the package is published to NPM? I don't think so but I wanted to raise it in case it was.

Copy link
Copy Markdown
Member Author

@Mrtenz Mrtenz Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see that this now goes after the doc publishing steps. Does it make sense for the doc publishing to go afterward instead?

They run in parallel, publish-release only needs publish-npm (just like get-release-version, which is used for publishing the docs).

This action also creates a Git tag in addition to creating the GitHub release. Do you think that will create a problem if the tag gets created after the package is published to NPM? I don't think so but I wanted to raise it in case it was.

Git and NPM tags are completely separate, so I don't think this should be a problem.

Copy link
Copy Markdown
Contributor

@mcmire mcmire Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gotcha, thanks, makes sense then.

env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Loading