mirror of
https://github.com/chartjs/Chart.js.git
synced 2026-03-13 03:36:50 +01:00
0616868959
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much. - Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) Signed-off-by: naveen <172697+naveensrinivasan@users.noreply.github.com>
97 lines
3.0 KiB
YAML
97 lines
3.0 KiB
YAML
name: Release
|
|
|
|
on:
|
|
release:
|
|
permissions:
|
|
contents: write # for actions/upload-release-asset to upload release asset
|
|
types: [published]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
setup:
|
|
permissions:
|
|
contents: none
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
version: ${{ steps.trim.outputs.version }}
|
|
steps:
|
|
- id: trim
|
|
run: echo "::set-output name=version::${TAG:1}"
|
|
env:
|
|
TAG: ${{ github.event.release.tag_name }}
|
|
|
|
release:
|
|
needs: setup
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v2
|
|
- uses: actions/setup-node@v2
|
|
with:
|
|
node-version: '14.x'
|
|
registry-url: https://registry.npmjs.org/
|
|
cache: npm
|
|
- name: Setup and build
|
|
run: |
|
|
npm ci
|
|
npm install -g json
|
|
json -I -f package.json -e "this.version=\"$VERSION\""
|
|
json -I -f package-lock.json -e "this.version=\"$VERSION\""
|
|
npm run build
|
|
./scripts/docs-config.sh "$VERSION" release
|
|
npm run docs
|
|
npm pack
|
|
env:
|
|
VERSION: ${{ needs.setup.outputs.version }}
|
|
- name: Publish to NPM
|
|
run: ./scripts/publish.sh
|
|
env:
|
|
NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
|
|
VERSION: ${{ needs.setup.outputs.version }}
|
|
- name: Deploy Docs
|
|
run: ./scripts/deploy-docs.sh "$VERSION" release
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GH_AUTH_TOKEN }}
|
|
GH_AUTH_EMAIL: ${{ secrets.GH_AUTH_EMAIL }}
|
|
VERSION: ${{ needs.setup.outputs.version }}
|
|
- name: Upload NPM package file
|
|
id: upload-npm-package-file
|
|
uses: actions/upload-release-asset@v1
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
VERSION: ${{ needs.setup.outputs.version }}
|
|
with:
|
|
upload_url: ${{ github.event.release.upload_url }}
|
|
asset_path: ${{ format('chart.js-{0}.tgz', needs.setup.outputs.version) }}
|
|
asset_name: ${{ format('chart.js-{0}.tgz', needs.setup.outputs.version) }}
|
|
asset_content_type: application/gzip
|
|
release-tag:
|
|
needs: [setup, release]
|
|
runs-on: ubuntu-latest
|
|
if: "!github.event.release.prerelease"
|
|
steps:
|
|
- uses: actions/checkout@v2
|
|
- uses: actions/setup-node@v2
|
|
with:
|
|
node-version: '14.x'
|
|
registry-url: https://registry.npmjs.org/
|
|
cache: npm
|
|
- name: Setup and build
|
|
run: |
|
|
npm ci
|
|
npm install -g json
|
|
json -I -f package.json -e "this.version=\"$VERSION\""
|
|
json -I -f package-lock.json -e "this.version=\"$VERSION\""
|
|
npm run build
|
|
./scripts/docs-config.sh "$VERSION"
|
|
npm run docs
|
|
env:
|
|
VERSION: ${{ needs.setup.outputs.version }}
|
|
- name: Deploy Docs
|
|
run: ./scripts/deploy-docs.sh "$VERSION"
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GH_AUTH_TOKEN }}
|
|
GH_AUTH_EMAIL: ${{ secrets.GH_AUTH_EMAIL }}
|
|
VERSION: ${{ needs.setup.outputs.version }}
|