mirror of
https://github.com/modelstudioai/cli.git
synced 2026-09-14 19:49:23 +08:00
若麒
3693f7dacb
Replace tools/release.mjs with two workflow_dispatch flows: - stable: production environment gate (Required Reviewers) + lightweight git tag. Trusted Publishing (OIDC) removes the need for an npm token. - channel beta: disposable 0.0.0-beta-<sha>-<date> versions on the corresponding dist-tag, no tag, no commit. Any collaborator can dispatch without npm credentials. Pack-time scans via publint, attw, gitleaks; weekly Dependabot for npm + actions.
48 lines
1.3 KiB
YAML
48 lines
1.3 KiB
YAML
name: Release (channel)
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
channel:
|
|
description: "dist-tag (kebab-case, e.g. mcp/plugin/advisor). Reserved: latest/beta/alpha/next/rc/canary/dev."
|
|
required: true
|
|
type: string
|
|
|
|
# Serialize channel releases per channel name to avoid racing tarball uploads.
|
|
concurrency:
|
|
group: release-channel-${{ inputs.channel }}
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read # no tag, no Release; just publish
|
|
id-token: write # OIDC for npm Trusted Publishing + provenance
|
|
|
|
jobs:
|
|
publish:
|
|
name: publish beta to npm
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: pnpm
|
|
registry-url: "https://registry.npmjs.org/"
|
|
|
|
- name: Install gitleaks
|
|
run: |
|
|
set -euo pipefail
|
|
GITLEAKS_VERSION=8.21.2
|
|
curl -sSfL \
|
|
"https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
|
|
| sudo tar -xz -C /usr/local/bin gitleaks
|
|
gitleaks version
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- name: publish-channel
|
|
run: node tools/release/publish-channel.mjs --channel "${{ inputs.channel }}"
|