d7e82ca1f6
Add ISC header to COMPATIBILITY.md, validate Claude marketplace json, record access-review notes after API success, checksum npm pack contents, trim dead package.json files entries, and mark listUsers organization_id as required. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
103 lines
3.6 KiB
YAML
103 lines
3.6 KiB
YAML
name: "Release skills"
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "@probo/skills/v*"
|
|
|
|
permissions:
|
|
contents: "read"
|
|
|
|
jobs:
|
|
publish:
|
|
name: "publish"
|
|
runs-on: "ubuntu-latest"
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
attestations: write
|
|
steps:
|
|
- uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6
|
|
with:
|
|
fetch-depth: 0
|
|
submodules: recursive
|
|
- uses: "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e" # v6
|
|
with:
|
|
node-version-file: ".nvmrc"
|
|
cache: "npm"
|
|
registry-url: "https://registry.npmjs.org"
|
|
scope: "@probo"
|
|
- run: "npm install -g npm@^11.8.0"
|
|
- run: "npm ci"
|
|
- name: "Verify package.json version matches tag"
|
|
run: |
|
|
TAG_VERSION="${GITHUB_REF_NAME##*/v}"
|
|
PKG_VERSION="$(node -p "require('./packages/skills/package.json').version")"
|
|
if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
|
|
echo "tag version ($TAG_VERSION) does not match package.json version ($PKG_VERSION)" >&2
|
|
exit 1
|
|
fi
|
|
- run: "npm --workspace @probo/skills run validate"
|
|
- uses: "anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610" # v0.24.0
|
|
with:
|
|
path: ./packages/skills
|
|
format: cyclonedx-json
|
|
output-file: packages/skills/sbom.json
|
|
- uses: "anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2" # v7.4.0
|
|
with:
|
|
path: ./packages/skills
|
|
fail-build: true
|
|
severity-cutoff: critical
|
|
- name: "Generate checksums for published files"
|
|
run: |
|
|
cd packages/skills
|
|
PACKFILE=$(npm pack --silent)
|
|
tar -tzf "$PACKFILE" \
|
|
| grep -v '/$' \
|
|
| sort \
|
|
| while read -r file; do
|
|
hash=$(tar -xOf "$PACKFILE" "$file" | sha256sum | head -c 64)
|
|
echo "$hash $file"
|
|
done > checksums.txt
|
|
rm -f "$PACKFILE"
|
|
test -s checksums.txt
|
|
- run: "npm --workspace @probo/skills publish --access public --dry-run"
|
|
- run: "npm --workspace @probo/skills publish --access public"
|
|
- uses: "actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e" # v4
|
|
with:
|
|
subject-path: "packages/skills/**"
|
|
sbom-path: "packages/skills/sbom.json"
|
|
- uses: "actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32" # v4
|
|
with:
|
|
subject-path: "packages/skills/**"
|
|
- name: "Extract release notes"
|
|
run: |
|
|
VERSION="${GITHUB_REF_NAME##*/v}"
|
|
awk -v ver="$VERSION" '
|
|
/^## \[/ { if (found) exit; if ($0 ~ "\\[" ver "\\]") found=1 }
|
|
found
|
|
' packages/skills/CHANGELOG.md > release-notes.md
|
|
- name: "Create GitHub release"
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
PRERELEASE_FLAG=""
|
|
if echo "${GITHUB_REF_NAME}" | grep -qE '(alpha|beta|rc)'; then
|
|
PRERELEASE_FLAG="--prerelease"
|
|
fi
|
|
|
|
gh release delete "${GITHUB_REF_NAME}" --yes 2>/dev/null || true
|
|
|
|
gh release create "${GITHUB_REF_NAME}" \
|
|
--title "${GITHUB_REF_NAME}" \
|
|
--notes-file release-notes.md \
|
|
$PRERELEASE_FLAG \
|
|
packages/skills/sbom.json packages/skills/checksums.txt
|
|
- uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7
|
|
with:
|
|
name: "skills-sbom"
|
|
path: |
|
|
packages/skills/sbom.json
|
|
packages/skills/checksums.txt
|
|
retention-days: 30
|