mirror of
https://github.com/apache/superset.git
synced 2026-07-25 08:02:28 +00:00
5b5e5cf82d
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
39 lines
1.3 KiB
YAML
39 lines
1.3 KiB
YAML
name: Embedded SDK Release
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- "master"
|
|
- "[0-9].[0-9]*"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
# Publishing uses npm trusted publishing (OIDC), so there is no NPM_TOKEN to
|
|
# gate on. Restrict to the canonical repo: forks cannot mint a valid OIDC
|
|
# token for this package and must not publish.
|
|
if: github.repository == 'apache/superset'
|
|
runs-on: ubuntu-26.04
|
|
permissions:
|
|
contents: read
|
|
id-token: write # required for npm trusted publishing (OIDC)
|
|
defaults:
|
|
run:
|
|
working-directory: superset-embedded-sdk
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
# Note: registry-url is intentionally omitted. When set, actions/setup-node
|
|
# writes an .npmrc with `_authToken=${NODE_AUTH_TOKEN}` and a placeholder
|
|
# token, which makes npm attempt token auth and skip the OIDC
|
|
# trusted-publishing exchange. With no .npmrc auth line, npm authenticates
|
|
# via OIDC against the default registry (registry.npmjs.org).
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version-file: "./superset-embedded-sdk/.nvmrc"
|
|
- run: npm ci
|
|
- run: npm run ci:release
|