node-release.yml

name: Node Release

on:
  workflow_call:
    inputs:
      node-version:
        type: string
        required: true
      build-script:
        type: string
        default: 'build'
      publish-command:
        type: string
        default: 'npm publish "$PACKAGE" --access public'
      registry-url:
        type: string
        default: 'https://registry.npmjs.org'
      create-release:
        type: boolean
        default: true
    secrets:
      MATRIX_ACCESS_TOKEN:
        required: false

jobs:
  # installs and builds without the permission to publish, a compromised dependency cannot publish
  build:
    runs-on: ubuntu-latest
    # a poisoned node_modules from the cache would end up in the published package
    cache-mode: none
    permissions:
      contents: read
    steps:
      - name: Check tag
        if: github.ref_type != 'tag'
        run: |
          echo "::error::node-release must run on a tag, not on ${GITHUB_REF}"
          exit 1

      - uses: $/.github/actions/node-setup
        with:
          node-version: ${{ inputs.node-version }}

      - name: Build
        if: inputs.build-script != ''
        env:
          BUILD_SCRIPT: ${{ inputs.build-script }}
        run: yarn run "$BUILD_SCRIPT"

      - name: Pack
        run: |
          if [[ "$(yarn --version)" == 1.* ]]; then
            yarn pack --filename "${RUNNER_TEMP}/package.tgz"
          else
            yarn pack --out "${RUNNER_TEMP}/package.tgz"
          fi

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: package
          path: ${{ runner.temp }}/package.tgz
          if-no-files-found: error
          retention-days: 1

  # runs no code of the dependencies, it publishes the package packed by the build job
  publish:
    needs: build
    runs-on: ubuntu-latest
    cache-mode: none
    permissions:
      contents: write
      id-token: write
    outputs:
      published: ${{ steps.publish.outcome }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: package
          path: ${{ runner.temp }}/package

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: ${{ inputs.node-version }}
          registry-url: ${{ inputs.registry-url }}

      - name: Publish
        id: publish
        env:
          PUBLISH_COMMAND: ${{ inputs.publish-command }}
          PACKAGE: ${{ runner.temp }}/package/package.tgz
        run: eval "$PUBLISH_COMMAND"

      - name: Create GitHub release
        if: inputs.create-release
        uses: $/.github/actions/github-release
        with:
          tag: ${{ github.ref_name }}

  notify:
    needs: [build, publish]
    if: ${{ !cancelled() }}
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - name: Compose the notification
        id: notification
        env:
          REPOSITORY: ${{ github.repository }}
          TAG: ${{ github.ref_name }}
          RESULT: ${{ needs.publish.result }}
          PUBLISHED: ${{ needs.publish.outputs.published }}
          LINK: ${{ inputs.create-release && format('{0}/{1}/releases/tag/{2}', github.server_url, github.repository, github.ref_name) || format('{0}/{1}/actions/runs/{2}', github.server_url, github.repository, github.run_id) }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          if [ "$RESULT" = success ]; then
            MESSAGE="✅ ${REPOSITORY} ${TAG} published: ${LINK}"
          elif [ "$PUBLISHED" = success ]; then
            MESSAGE="⚠️ ${REPOSITORY} ${TAG} published, but the GitHub release failed: ${RUN_URL}"
          else
            MESSAGE="❌ Publishing ${TAG} of ${REPOSITORY} failed: ${RUN_URL}"
          fi
          echo "message=${MESSAGE}" >> "$GITHUB_OUTPUT"

      - name: Notify Matrix
        continue-on-error: true
        uses: $/.github/actions/matrix-notify
        with:
          message: ${{ steps.notification.outputs.message }}
          homeserver: ${{ vars.MATRIX_HOMESERVER }}
          room-id: ${{ vars.MATRIX_ROOM_ID }}
          token: ${{ secrets.MATRIX_ACCESS_TOKEN }}