ci: Upgrade Claude action permission checks #588
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Package Preview Publish | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| # This workflow deliberately does NOT run the Wix gateway proxy: the gateway | |
| # cannot carry `npm publish` (it rejects `PUT /<package>`), so per secplatform's | |
| # interim policy for OSS repos this job relies on `npm ci` against the committed | |
| # package-lock.json plus .npmrc's min-release-age instead. It resolves nothing, | |
| # so dropping the gateway does not widen what it can pull. Exemption lives in | |
| # .github/scripts/check_wix_proxy_steps.py. | |
| jobs: | |
| publish-preview: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # id-token: write for npm trusted publishing (OIDC). | |
| # pull-requests: write for the install-instructions comment. | |
| contents: read | |
| id-token: write | |
| pull-requests: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Enable corepack | |
| run: corepack enable | |
| # Node 24, not 20: its bundled npm (>= 11.17) already covers trusted | |
| # publishing (needs >= 11.5.1) and reads .npmrc's min-release-age (needs | |
| # >= 11.10.0), so there is no `npm install -g npm@11` fetching a floating | |
| # npm release outside the cooldown. | |
| - name: Setup Node.js | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: 24 | |
| cache: "npm" | |
| registry-url: "https://registry.npmjs.org" | |
| # `npm ci`, not `npm install`: without the gateway in front of this job, a | |
| # resolving install is the one thing that could pull a fresh release. `npm ci` | |
| # installs exactly what package-lock.json pins and resolves nothing. | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build package | |
| run: npm run build | |
| - name: Generate preview package name and version | |
| id: preview_info | |
| run: | | |
| PR_NUMBER="${{ github.event.number }}" | |
| COMMIT_HASH="${{ github.sha }}" | |
| SHORT_COMMIT="${COMMIT_HASH:0:7}" | |
| # Get current version from package.json | |
| BASE_VERSION=$(node -p "require('./package.json').version") | |
| if [ ! -z "$PR_NUMBER" ]; then | |
| # Format: 0.3.0-pr.123.abc1234 (valid semver prerelease) | |
| PREVIEW_VERSION="$BASE_VERSION-pr.$PR_NUMBER.$SHORT_COMMIT" | |
| else | |
| # Format: 0.3.0-dev.abc1234 (valid semver prerelease) | |
| PREVIEW_VERSION="$BASE_VERSION-dev.$SHORT_COMMIT" | |
| fi | |
| echo "version=$PREVIEW_VERSION" >> $GITHUB_OUTPUT | |
| echo "package_name=@base44-preview/sdk" >> $GITHUB_OUTPUT | |
| echo "full_package=@base44-preview/sdk@$PREVIEW_VERSION" >> $GITHUB_OUTPUT | |
| - name: Update package.json for preview | |
| run: | | |
| # Create a backup of original package.json | |
| cp package.json package.json.bak | |
| # Get the official package name for safety checks | |
| OFFICIAL_PACKAGE=$(node -p "require('./package.json').name") | |
| PREVIEW_PACKAGE="${{ steps.preview_info.outputs.package_name }}" | |
| echo "Official package: $OFFICIAL_PACKAGE" | |
| echo "Preview package: $PREVIEW_PACKAGE" | |
| # Safety check: Ensure we're not accidentally using the official package name | |
| if [ "$PREVIEW_PACKAGE" = "$OFFICIAL_PACKAGE" ]; then | |
| echo "❌ ERROR: Preview package name matches official package name!" | |
| echo "This would overwrite the official package. Aborting." | |
| exit 1 | |
| fi | |
| # Update name with error handling | |
| if ! npm pkg set name="$PREVIEW_PACKAGE"; then | |
| echo "❌ ERROR: Failed to set package name to $PREVIEW_PACKAGE" | |
| exit 1 | |
| fi | |
| # Update version with error handling | |
| if ! npm pkg set version="${{ steps.preview_info.outputs.version }}"; then | |
| echo "❌ ERROR: Failed to set package version to ${{ steps.preview_info.outputs.version }}" | |
| exit 1 | |
| fi | |
| echo "✅ Package.json updated successfully" | |
| - name: Final safety check before publish | |
| run: | | |
| # Double-check package name one more time before publishing | |
| CURRENT_PACKAGE_NAME=$(node -p "require('./package.json').name") | |
| OFFICIAL_PACKAGE=$(jq -r '.name' package.json.bak) | |
| echo "About to publish: $CURRENT_PACKAGE_NAME" | |
| if [ "$CURRENT_PACKAGE_NAME" = "$OFFICIAL_PACKAGE" ]; then | |
| echo "❌ CRITICAL ERROR: About to publish to official package name!" | |
| echo "This is not allowed. Check the workflow configuration." | |
| exit 1 | |
| fi | |
| echo "✅ Safety check passed. Package name is safe to publish." | |
| - name: Publish preview package | |
| # Authenticates via npm trusted publishing (OIDC), so no NPM_TOKEN reaches | |
| # the build. Needs a trusted publisher for `@base44-preview/sdk` on | |
| # npmjs.com registered against this repo and this workflow filename — the | |
| # registry keys on the filename, so this needs its own entry, separate from | |
| # manual-publish.yml. | |
| run: | | |
| if npm publish --tag preview; then | |
| echo "✅ Package published successfully" | |
| else | |
| echo "❌ Package publish failed" | |
| exit 1 | |
| fi | |
| - name: Restore original package.json | |
| if: always() | |
| run: | | |
| if [ -f package.json.bak ]; then | |
| mv package.json.bak package.json | |
| echo "✅ Original package.json restored" | |
| else | |
| echo "❌ WARNING: Backup file package.json.bak not found" | |
| echo "This could indicate an earlier step failed" | |
| fi | |
| - name: Comment PR with install instructions | |
| uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6 | |
| with: | |
| script: | | |
| const fullPackage = '${{ steps.preview_info.outputs.full_package }}'; | |
| const installCmd = `npm i ${fullPackage}`; | |
| const aliasInstallCmd = `npm i "@base44/sdk@npm:${fullPackage}"`; | |
| const body = `### 🚀 Package Preview Available! | |
| --- | |
| **Install this PR's preview build with npm:** | |
| \`\`\`sh | |
| ${installCmd} | |
| \`\`\` | |
| **Prefer not to change any import paths? Install using npm alias so your code still imports \`@base44/sdk\`:** | |
| \`\`\`sh | |
| ${aliasInstallCmd} | |
| \`\`\` | |
| Or add it to your \`package.json\` dependencies: | |
| \`\`\`json | |
| { | |
| "dependencies": { | |
| "@base44/sdk": "npm:${fullPackage}" | |
| } | |
| } | |
| \`\`\` | |
| - 📦 **Preview Package**: \`${fullPackage}\` | |
| - 🔗 [View this commit on GitHub](https://github.com/${{ github.repository }}/commit/${{ github.sha }}) | |
| --- | |
| <sub>Preview published to npm registry — try new features instantly!</sub>`; | |
| const botCommentIdentifier = '### 🚀 Package Preview Available!'; | |
| async function findBotComment(issueNumber) { | |
| if (!issueNumber) return null; | |
| const comments = await github.rest.issues.listComments({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: issueNumber, | |
| }); | |
| return comments.data.find((comment) => | |
| comment.body.includes(botCommentIdentifier) | |
| ); | |
| } | |
| async function createOrUpdateComment(issueNumber) { | |
| if (!issueNumber) { | |
| console.log('No issue number provided. Cannot post or update comment.'); | |
| return; | |
| } | |
| const existingComment = await findBotComment(issueNumber); | |
| if (existingComment) { | |
| await github.rest.issues.updateComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| comment_id: existingComment.id, | |
| body: body, | |
| }); | |
| } else { | |
| await github.rest.issues.createComment({ | |
| issue_number: issueNumber, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: body, | |
| }); | |
| } | |
| } | |
| if (context.eventName === 'pull_request') { | |
| if (context.issue.number) { | |
| await createOrUpdateComment(context.issue.number); | |
| } | |
| } |