mirror of
https://github.com/apache/superset.git
synced 2026-07-09 08:15:49 +00:00
49 lines
1.7 KiB
YAML
49 lines
1.7 KiB
YAML
name: Embedded SDK Release
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- "master"
|
|
- "[0-9].[0-9]*"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
# Publishing uses npm trusted publishing (OIDC), so there is no NPM_TOKEN to
|
|
# gate on. Restrict to the canonical repo: forks cannot mint a valid OIDC
|
|
# token for this package and must not publish.
|
|
if: github.repository == 'apache/superset'
|
|
runs-on: ubuntu-24.04
|
|
permissions:
|
|
contents: read
|
|
id-token: write # required for npm trusted publishing (OIDC)
|
|
defaults:
|
|
run:
|
|
working-directory: superset-embedded-sdk
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
persist-credentials: false
|
|
# Note: registry-url is intentionally omitted. When set, actions/setup-node
|
|
# writes an .npmrc with `_authToken=${NODE_AUTH_TOKEN}` and a placeholder
|
|
# token, which makes npm attempt token auth and skip the OIDC
|
|
# trusted-publishing exchange. With no .npmrc auth line, npm authenticates
|
|
# via OIDC against the default registry (registry.npmjs.org).
|
|
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
|
with:
|
|
node-version-file: "./superset-embedded-sdk/.nvmrc"
|
|
# Diagnostic: confirm GitHub OIDC is granted to this job. npm trusted
|
|
# publishing needs the id-token request env vars; "no" here means OIDC was
|
|
# not issued and publishing cannot authenticate.
|
|
- name: Check OIDC availability
|
|
run: |
|
|
if [ -n "${ACTIONS_ID_TOKEN_REQUEST_URL}" ]; then
|
|
echo "GitHub OIDC available to job: yes"
|
|
else
|
|
echo "GitHub OIDC available to job: no"
|
|
fi
|
|
- run: npm ci
|
|
- run: npm run ci:release
|