Skip to content

Commit 377da6b

Browse files
mnahkiesmnahkies
authored
feat: adopt trusted publishers (#121)
adopting https://docs.npmjs.com/trusted-publishers for better transparency and supply chain security.
1 parent 13ba1c1 commit 377da6b

6 files changed

Lines changed: 69 additions & 20 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,6 @@ permissions:
1515
jobs:
1616
build:
1717
runs-on: ubuntu-latest
18-
strategy:
19-
matrix:
20-
node-version: [22.x]
21-
# See supported Node.js release schedule at https://nodejs.org/en/about/releases/
22-
2318
steps:
2419
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2520
with:
@@ -28,11 +23,11 @@ jobs:
2823
- name: Install pnpm
2924
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
3025

31-
- name: Use Node.js ${{ matrix.node-version }}
26+
- name: Use Node.js
3227
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
3328
with:
3429
registry-url: "https://registry.npmjs.org"
35-
node-version: ${{ matrix.node-version }}
30+
node-version-file: '.nvmrc'
3631
cache: "pnpm"
3732

3833
- run: pnpm install --frozen-lockfile
@@ -42,11 +37,3 @@ jobs:
4237
- run: pnpm run ci-test
4338

4439
- run: pnpm run ci-lint
45-
46-
- name: Publish documentation
47-
if: github.ref == 'refs/heads/master'
48-
run: |
49-
git config user.name "github-actions[bot]"
50-
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
51-
git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/$GITHUB_REPOSITORY
52-
pnpm run publish:gh-pages

‎.github/workflows/publish.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: publish
2+
on:
3+
push:
4+
tags:
5+
- 'v[0-9]+.[0-9]+.[0-9]+'
6+
7+
permissions:
8+
contents: read
9+
id-token: write
10+
11+
jobs:
12+
publish:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
16+
with:
17+
fetch-depth: 0
18+
19+
- name: Install pnpm
20+
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
21+
22+
- name: Use Node.js
23+
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
24+
with:
25+
registry-url: "https://registry.npmjs.org"
26+
node-version-file: '.nvmrc'
27+
cache: "pnpm"
28+
29+
- name: Validate tag matches package.json
30+
run: |
31+
TAG_VERSION="${{ github.ref_name }}"
32+
PKG_VERSION=$(jq -r .version projects/ng-qrcode/package.json)
33+
34+
echo "Git tag version: $TAG_VERSION"
35+
echo "package.json version: $PKG_VERSION"
36+
37+
if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
38+
echo "ERROR: Git tag does not match package.json version"
39+
exit 1
40+
fi
41+
42+
- run: pnpm install --frozen-lockfile
43+
44+
- run: pnpm run build-for-publish
45+
46+
- name: Publish to npm
47+
working-directory: ./dist/ng-qrcode
48+
run: |
49+
pnpm publish
50+
51+
- name: Publish documentation
52+
run: |
53+
git config user.name "github-actions[bot]"
54+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
55+
git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/$GITHUB_REPOSITORY
56+
pnpm run publish:gh-pages

‎CHANGES.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
# 20.0.1 - 2025-10-26
2+
- Adopt trusted publishers (#121)
3+
- Switch to `pnpm` and adopt a 1 week minimum release age for dependencies (#116)
4+
15
# 20.0.0 - 2025-05-31
26
- Support Angular 20 (#115)
37

‎package.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,18 +16,18 @@
1616
"url": "https://github.com/mnahkies/ng-qrcode/issues"
1717
},
1818
"scripts": {
19-
"postinstall": "husky",
19+
"prepare": "husky",
2020
"clean": "rm -rf ./dist ./coverage",
2121
"docs:generate": "node ./scripts/generate-toc.mjs",
2222
"start": "ng serve",
2323
"build": "ng build --project ng-qrcode --configuration production",
24-
"build-for-publish": "ng build --project ng-qrcode --configuration production && cp ./README.md ./CHANGES.md ./LICENSE ./dist/ng-qrcode/",
24+
"build-for-publish": "ng build --project ng-qrcode --configuration production && pnpm run copy:docs",
2525
"build-demo-app": "ng build --project=ng-qrcode-demo --configuration production --base-href '/ng-qrcode/'",
2626
"publish:gh-pages": "pnpm run build-demo-app && pnpm exec gh-pages -d ./dist/ng-qrcode-demo/browser -b gh-pages --nojekyll",
2727
"test": "ng test",
2828
"lint": "ng lint",
29-
"ci-pipeline": "pnpm run clean && pnpm run ci-build && pnpm run ci-test && pnpm run ci-lint",
30-
"postci-pipeline": "cp ./README.md ./CHANGES.md ./LICENSE ./dist/ng-qrcode/",
29+
"ci-pipeline": "pnpm run clean && pnpm run ci-build && pnpm run ci-test && pnpm run ci-lint && pnpm run copy:docs",
30+
"copy:docs": "cp ./README.md ./CHANGES.md ./LICENSE ./dist/ng-qrcode/",
3131
"ci-build": "ng build --project ng-qrcode --configuration production && ng build --project=ng-qrcode-demo --configuration production",
3232
"ci-test": "ng test --code-coverage",
3333
"ci-lint": "ng lint"

‎pnpm-workspace.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
minimumReleaseAge: 10080 # 7 days in minutes
22

3+
# GH actions doesn't checkout the branch
4+
gitChecks: false

‎projects/ng-qrcode/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "ng-qrcode",
33
"description": "Simple AOT compatible QR code generator for your Angular project.",
4-
"version": "20.0.0",
4+
"version": "20.0.1",
55
"license": "MIT",
66
"author": {
77
"name": "Michael Nahkies",

0 commit comments

Comments
 (0)