From 521ad83930f19c2da89e9226fc7ae544e53ad648 Mon Sep 17 00:00:00 2001 From: Kai Salmen Date: Fri, 10 Jul 2026 14:45:29 +0200 Subject: [PATCH 1/7] Fix workflow permissions and change to preview of action --- .github/workflows/main.yml | 13 ++++++++++++- .github/workflows/scripts/checkStatus.sh | 3 +++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index c5f0596fd..16c701f0f 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,5 +1,9 @@ name: Build, Lint and Test +permissions: + contents: read + id-token: write + on: push: branches: @@ -23,6 +27,11 @@ on: required: false default: '' type: string + verbose: + description: 'npm publish with verbose output' + required: true + default: false + type: boolean jobs: build: @@ -66,16 +75,18 @@ jobs: env: NPM_DRY_RUN: ${{ github.event.inputs.dryRun }} NPM_TAG: ${{ github.event.inputs.npmTag }} + NPM_VERBOSE: ${{ github.event.inputs.verbose }} # logs the ENV values and stores them back in GITHUB_ENV with proper defaults for the next step run: | ./.github/workflows/scripts/checkStatus.sh - name: Publish # dry-run can only be set to false if executed manually - uses: TypeFox/gh-publish-npm@fd8799b805ddfb79d82fbdfed8efdc9a1fad8f25 # v0.3.2 + uses: TypeFox/gh-publish-npm@7f487ef219d953f46274fc1c67dfc835c53fbc11 # v0.3.3 / dev with: dry-run: ${{ env.NPM_DRY_RUN }} npm-tag: ${{ env.NPM_TAG }} + verbose: ${{ env.NPM_VERBOSE }} npm-packages: | packages/client packages/vscode-ws-jsonrpc diff --git a/.github/workflows/scripts/checkStatus.sh b/.github/workflows/scripts/checkStatus.sh index 1694b43ae..59d446cc0 100755 --- a/.github/workflows/scripts/checkStatus.sh +++ b/.github/workflows/scripts/checkStatus.sh @@ -4,9 +4,12 @@ echo -e "\nReporting env variable values:" npmDryRun=${NPM_DRY_RUN:-true} npmTag=${NPM_TAG:-''} +npmVerbose=${NPM_VERBOSE:-false} echo "NPM_DRY_RUN: ${npmDryRun}" echo "NPM_TAG: ${npmTag}" +echo "NPM_VERBOSE: ${npmVerbose}" echo "NPM_DRY_RUN=${npmDryRun}" >> $GITHUB_ENV echo "NPM_TAG=${npmTag}" >> $GITHUB_ENV +echo "NPM_VERBOSE=${npmVerbose}" >> $GITHUB_ENV From e8f00508f9762d4ac3cf52f014eefaa9fd105fd7 Mon Sep 17 00:00:00 2001 From: Kai Salmen Date: Mon, 13 Jul 2026 09:18:33 +0200 Subject: [PATCH 2/7] Split publish and main workflows again --- .github/workflows/main.yml | 38 +---------- .github/workflows/publish_oidc.yml | 85 ++++++++++++++++++++++++ .github/workflows/scripts/checkStatus.sh | 10 +-- 3 files changed, 94 insertions(+), 39 deletions(-) create mode 100644 .github/workflows/publish_oidc.yml diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 16c701f0f..9a5236a45 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,9 +1,5 @@ name: Build, Lint and Test -permissions: - contents: read - id-token: write - on: push: branches: @@ -15,23 +11,6 @@ on: branches: - main - dev - workflow_dispatch: - inputs: - dryRun: - description: 'Perform a dry run without publishing to npm' - required: true - default: true - type: boolean - npmTag: - description: 'Enforce a specific tag for creating a pre-release. If not provided, the tag will be determined automatically based on the version in package.json' - required: false - default: '' - type: string - verbose: - description: 'npm publish with verbose output' - required: true - default: false - type: boolean jobs: build: @@ -71,22 +50,11 @@ jobs: run: | npm run test:ci:tags - - name: Setup - env: - NPM_DRY_RUN: ${{ github.event.inputs.dryRun }} - NPM_TAG: ${{ github.event.inputs.npmTag }} - NPM_VERBOSE: ${{ github.event.inputs.verbose }} - # logs the ENV values and stores them back in GITHUB_ENV with proper defaults for the next step - run: | - ./.github/workflows/scripts/checkStatus.sh - - - name: Publish - # dry-run can only be set to false if executed manually + - name: Publish Dry-Run uses: TypeFox/gh-publish-npm@7f487ef219d953f46274fc1c67dfc835c53fbc11 # v0.3.3 / dev with: - dry-run: ${{ env.NPM_DRY_RUN }} - npm-tag: ${{ env.NPM_TAG }} - verbose: ${{ env.NPM_VERBOSE }} + dry-run: true + verbose: true npm-packages: | packages/client packages/vscode-ws-jsonrpc diff --git a/.github/workflows/publish_oidc.yml b/.github/workflows/publish_oidc.yml new file mode 100644 index 000000000..9bc0b6bfd --- /dev/null +++ b/.github/workflows/publish_oidc.yml @@ -0,0 +1,85 @@ +name: Publish via OIDC + +permissions: + contents: read + id-token: write + +on: + push: + branches: + - 'fix-publish-permissions' + tags: + - '*-*.*.*' + workflow_dispatch: + inputs: + dryRun: + description: 'Perform a dry run without publishing to npm' + required: true + default: true + type: boolean + npmTag: + description: 'Enforce a specific tag for creating a pre-release. If not provided, the tag will be determined automatically based on the version in package.json' + required: false + default: '' + type: string + verbose: + description: 'npm publish with verbose output' + required: true + default: false + type: boolean + +jobs: + build: + runs-on: ubuntu-latest + timeout-minutes: 10 + + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - name: mise-en-place + uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 + + - name: Install + shell: bash + run: | + npm ci + + - name: Versions Report & Setup + shell: bash + env: + NPM_DRY_RUN: ${{ github.event.inputs.dryRun }} + NPM_TAG: ${{ github.event.inputs.npmTag }} + NPM_VERBOSE: ${{ github.event.inputs.verbose }} + # logs the ENV values and stores them back in GITHUB_ENV with proper defaults for the next step + run: | + npm run report:versions + ./.github/workflows/scripts/checkStatus.sh + + - name: Build + shell: bash + run: | + npm run build + + - name: Lint & Format + shell: bash + run: | + npm run lint + npm run fmt + + - name: Test + shell: bash + run: | + npm run test:ci:tags + + - name: Publish + # dry-run can only be set to false if executed manually + uses: TypeFox/gh-publish-npm@7f487ef219d953f46274fc1c67dfc835c53fbc11 # v0.3.3 / dev + with: + dry-run: false + npm-tag: ${{ env.NPM_TAG }} + verbose: ${{ env.NPM_VERBOSE }} + npm-packages: | + packages/client + packages/vscode-ws-jsonrpc + packages/wrapper-react diff --git a/.github/workflows/scripts/checkStatus.sh b/.github/workflows/scripts/checkStatus.sh index 59d446cc0..d63be4beb 100755 --- a/.github/workflows/scripts/checkStatus.sh +++ b/.github/workflows/scripts/checkStatus.sh @@ -6,10 +6,12 @@ npmDryRun=${NPM_DRY_RUN:-true} npmTag=${NPM_TAG:-''} npmVerbose=${NPM_VERBOSE:-false} -echo "NPM_DRY_RUN: ${npmDryRun}" -echo "NPM_TAG: ${npmTag}" -echo "NPM_VERBOSE: ${npmVerbose}" - echo "NPM_DRY_RUN=${npmDryRun}" >> $GITHUB_ENV echo "NPM_TAG=${npmTag}" >> $GITHUB_ENV echo "NPM_VERBOSE=${npmVerbose}" >> $GITHUB_ENV + +echo -e "\nReporting environment variables:\n" + +echo "NPM_DRY_RUN: ${npmDryRun}" +echo "NPM_TAG: ${npmTag}" +echo "NPM_VERBOSE: ${npmVerbose}" From fb4f1e156a90da2ec546e8b1da1653758737d087 Mon Sep 17 00:00:00 2001 From: Kai Salmen Date: Mon, 13 Jul 2026 10:54:55 +0200 Subject: [PATCH 3/7] Adjust mise config to not use cache and set the github_token --- .github/workflows/publish_oidc.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/publish_oidc.yml b/.github/workflows/publish_oidc.yml index 9bc0b6bfd..59a31d929 100644 --- a/.github/workflows/publish_oidc.yml +++ b/.github/workflows/publish_oidc.yml @@ -39,6 +39,9 @@ jobs: - name: mise-en-place uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 + with: + cache: false + github_token: ${{ secrets.GITHUB_TOKEN }} - name: Install shell: bash From f2c9e03ca2caff7bd09db8264db2119694addf98 Mon Sep 17 00:00:00 2001 From: Kai Salmen Date: Mon, 13 Jul 2026 11:13:41 +0200 Subject: [PATCH 4/7] Check npm log files after publish --- .github/workflows/publish_oidc.yml | 6 ++++++ .github/workflows/scripts/checkNpmLogs.sh | 6 ++++++ 2 files changed, 12 insertions(+) create mode 100755 .github/workflows/scripts/checkNpmLogs.sh diff --git a/.github/workflows/publish_oidc.yml b/.github/workflows/publish_oidc.yml index 59a31d929..66ae7dbeb 100644 --- a/.github/workflows/publish_oidc.yml +++ b/.github/workflows/publish_oidc.yml @@ -86,3 +86,9 @@ jobs: packages/client packages/vscode-ws-jsonrpc packages/wrapper-react + + - name: Checkmnpm logs + if: always() + shell: bash + run: | + ./.github/workflows/scripts/checkNpmLogs.sh diff --git a/.github/workflows/scripts/checkNpmLogs.sh b/.github/workflows/scripts/checkNpmLogs.sh new file mode 100755 index 000000000..14c01193b --- /dev/null +++ b/.github/workflows/scripts/checkNpmLogs.sh @@ -0,0 +1,6 @@ +#!/bin/bash + +latest_log=$(ls /home/runner/.npm/_logs/*debug*.log | sort | tail -n 1) +if [ -f $latest_log ]; then + cat $latest_log +fi From ef75847018781a4785c99ce1f07b3b4d1218b227 Mon Sep 17 00:00:00 2001 From: Kai Salmen Date: Mon, 13 Jul 2026 11:31:00 +0200 Subject: [PATCH 5/7] Add publish environment --- .github/workflows/publish_oidc.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish_oidc.yml b/.github/workflows/publish_oidc.yml index 66ae7dbeb..d219fe45c 100644 --- a/.github/workflows/publish_oidc.yml +++ b/.github/workflows/publish_oidc.yml @@ -29,8 +29,9 @@ on: type: boolean jobs: - build: + publish_oidc: runs-on: ubuntu-latest + environment: publish timeout-minutes: 10 steps: @@ -87,7 +88,7 @@ jobs: packages/vscode-ws-jsonrpc packages/wrapper-react - - name: Checkmnpm logs + - name: Check npm logs if: always() shell: bash run: | From 5f21288386e4e12f55deb8462b39147816424af6 Mon Sep 17 00:00:00 2001 From: Kai Salmen Date: Mon, 13 Jul 2026 11:58:47 +0200 Subject: [PATCH 6/7] Enforce publish on workflow dispatch only --- .github/workflows/main.yml | 1 + .github/workflows/publish_oidc.yml | 7 +++---- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 9a5236a45..0725bfc00 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -51,6 +51,7 @@ jobs: npm run test:ci:tags - name: Publish Dry-Run + # dry-run is always performed uses: TypeFox/gh-publish-npm@7f487ef219d953f46274fc1c67dfc835c53fbc11 # v0.3.3 / dev with: dry-run: true diff --git a/.github/workflows/publish_oidc.yml b/.github/workflows/publish_oidc.yml index d219fe45c..26f98ab8f 100644 --- a/.github/workflows/publish_oidc.yml +++ b/.github/workflows/publish_oidc.yml @@ -6,8 +6,6 @@ permissions: on: push: - branches: - - 'fix-publish-permissions' tags: - '*-*.*.*' workflow_dispatch: @@ -77,10 +75,11 @@ jobs: npm run test:ci:tags - name: Publish - # dry-run can only be set to false if executed manually + # dry-run can only be set to false if executed manually via workflow_dispatch + # tagged run only performs a dry-run for now uses: TypeFox/gh-publish-npm@7f487ef219d953f46274fc1c67dfc835c53fbc11 # v0.3.3 / dev with: - dry-run: false + dry-run: ${{ env.NPM_DRY_RUN }} npm-tag: ${{ env.NPM_TAG }} verbose: ${{ env.NPM_VERBOSE }} npm-packages: | From c2d4b89f829eae15e8e3ba28c814ee23fc4c598d Mon Sep 17 00:00:00 2001 From: Kai Salmen Date: Mon, 13 Jul 2026 13:12:19 +0200 Subject: [PATCH 7/7] Update to latest dev version of gh-publish-npm --- .github/workflows/main.yml | 3 ++- .github/workflows/publish_oidc.yml | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 0725bfc00..f3b8dd898 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -52,10 +52,11 @@ jobs: - name: Publish Dry-Run # dry-run is always performed - uses: TypeFox/gh-publish-npm@7f487ef219d953f46274fc1c67dfc835c53fbc11 # v0.3.3 / dev + uses: TypeFox/gh-publish-npm@4e114cef5985f2ab293188d9412ff63292bba217 # v0.3.3 / dev with: dry-run: true verbose: true + npm-tag: 'next' npm-packages: | packages/client packages/vscode-ws-jsonrpc diff --git a/.github/workflows/publish_oidc.yml b/.github/workflows/publish_oidc.yml index 26f98ab8f..fc6bf936c 100644 --- a/.github/workflows/publish_oidc.yml +++ b/.github/workflows/publish_oidc.yml @@ -16,9 +16,9 @@ on: default: true type: boolean npmTag: - description: 'Enforce a specific tag for creating a pre-release. If not provided, the tag will be determined automatically based on the version in package.json' + description: 'Enforce a specific tag for version comparisons. If not provided, the default tag "latest" will be used.' required: false - default: '' + default: 'next' type: string verbose: description: 'npm publish with verbose output' @@ -77,7 +77,7 @@ jobs: - name: Publish # dry-run can only be set to false if executed manually via workflow_dispatch # tagged run only performs a dry-run for now - uses: TypeFox/gh-publish-npm@7f487ef219d953f46274fc1c67dfc835c53fbc11 # v0.3.3 / dev + uses: TypeFox/gh-publish-npm@4e114cef5985f2ab293188d9412ff63292bba217 # v0.3.3 / dev with: dry-run: ${{ env.NPM_DRY_RUN }} npm-tag: ${{ env.NPM_TAG }}