opencontext/.github/workflows/release.yml at main · melandlabs/opencontext · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
name: Release

# Publishes @melandlabs/* packages to npm via changesets.
# Triggered after the CI workflow passes on main — a release PR is opened
# (or updated) by changesets when changesets are present, and merged via
# the "Version Packages" PR. This workflow runs on push to main and uses
# NPM_ACCESS_TOKEN (configured as a repo secret) to authenticate against
# https://registry.npmjs.org/.

on:
  push:
    branches: [main]

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    name: Publish to npm
    runs-on: ubuntu-latest
    # Only publish when changesets reports new versions. The
    # "changesets/action" step handles versioning, commit, and PR
    # creation; we only run `pnpm changeset publish` once that work
    # is done and we're pushing the resulting commit back to main.
    if: "${{ github.event.head_commit.message != 'ci: skip publish' }}"
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@v4
        with:
          version: 10.14.0

      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: pnpm
          # Always publish against npmjs.org — the user-facing registry.
          registry-url: https://registry.npmjs.org/

      - run: pnpm install --frozen-lockfile

      # Build every package so the published tarballs contain fresh dist/.
      #
      # Note: OKF ↔ memory-store form a workspace cycle. The OKF side
      # (`packages/okf/src/cli.ts`) hand-writes the raw-store interface
      # and indirect-imports memory-store through a string variable, so
      # tsup DTS doesn't need to resolve `@melandlabs/memory-store` at
      # emit time and pnpm can schedule the two `tsup` runs in parallel
      # without a DTS race. `pnpm -r build` works in a single pass.
      - run: pnpm -r build

      # Publish with the access token from NPM_ACCESS_TOKEN. `--no-git-tag`
      # avoids changesets trying to push a tag (we let the version PR do
      # that); `--tag latest` is the default but stated explicitly.
      - name: Publish
        env:
          NPM_ACCESS_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
        run: pnpm changeset publish --no-git-tag --tag latest
        shell: bash

  smoke:
    name: Smoke test published packages
    runs-on: ubuntu-latest
    needs: publish
    # Runs after a successful publish to verify the artifacts on the
    # public registry. Uses the same examples/ suite as the local smoke
    # test, but installs dependencies straight from npmjs.org.
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: 10.14.0

      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: pnpm
          registry-url: https://registry.npmjs.org/

      - name: Run smoke tests
        working-directory: examples
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
          # Optional secrets — when set, the corresponding demos
          # exercise live calls instead of skipping:
          #   - demo/search    → BRAVE_SEARCH_API_KEY   (Brave web search)
          #   - demo/ai-agent  → ANTHROPIC_API_KEY     (preferred),
          #                      with fallbacks OPENAI_API_KEY /
          #                      OPENROUTER_API_KEY.
          # If a secret isn't configured on the repo, the matching
          # demo still SKIPs cleanly (the demos short-circuit on
          # `process.env.<KEY>`), so it's safe to add them later
          # without touching this workflow again.
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          BRAVE_SEARCH_API_KEY: ${{ secrets.BRAVE_SEARCH_API_KEY }}
        run: |
          # `--ignore-workspace` drops the surrounding pnpm-workspace.yaml
          # context so pnpm actually pulls every @melandlabs/* from
          # npmjs.org. Without it, pnpm links to the monorepo's
          # `packages/*` source trees (whose `dist/` was never built in
          # this job) and every example fails with ERR_MODULE_NOT_FOUND
          # against an empty dist.
          pnpm install --ignore-workspace --registry=https://registry.npmjs.org
          pnpm test