millionco__react-doctor/.github/workflows/publish.yml

name: Publish

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      force_publish:
        description: "Run pnpm release even with no pending changesets (finish a partial publish)"
        type: boolean
        default: false

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v5

      - uses: pnpm/action-setup@v5

      - uses: actions/setup-node@v5
        with:
          node-version: 22.18.0
          cache: pnpm
          # Do NOT set registry-url here: setup-node writes an empty
          # //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN} line that
          # prevents npm Trusted Publishing OIDC from firing
          # (actions/setup-node#1551). publish-dev still has it for classic
          # token flows; stable publish is OIDC-only.

      - run: npm install -g npm@11

      - run: pnpm install --frozen-lockfile

      - name: Force publish remaining package versions
        if: ${{ github.event_name == 'workflow_dispatch' && inputs.force_publish }}
        env:
          NPM_CONFIG_PROVENANCE: true
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
        run: pnpm release

      - name: Create release PR or publish
        if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.force_publish) }}
        id: changesets
        uses: changesets/action@v1
        with:
          publish: pnpm release
          version: pnpm run version
          title: "chore: version packages"
          commit: "chore: version packages"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
          # When `pnpm release` actually publishes, its `sentry-sourcemaps`
          # step injects Debug IDs into dist/cli.js and uploads the maps to
          # Sentry under `react-doctor@<version>` (no-op if these are unset).
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}

  publish-dev:
    name: Publish @dev snapshot
    needs: publish
    if: ${{ !cancelled() && needs.publish.result != 'failure' }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v5

      - uses: pnpm/action-setup@v5

      - uses: actions/setup-node@v5
        with:
          node-version: 22.18.0
          cache: pnpm
          registry-url: https://registry.npmjs.org

      - run: npm install -g npm@11

      - run: pnpm install --frozen-lockfile

      - name: Compute dev version
        id: dev-version
        run: |
          base_version="$(node -p "require('./packages/react-doctor/package.json').version")"
          dev_version="${base_version}-dev.$(git rev-parse --short HEAD)"
          echo "version=${dev_version}" >> "$GITHUB_OUTPUT"
          echo "Publishing dev snapshot ${dev_version}"

      - name: Apply dev version to published packages
        env:
          DEV_VERSION: ${{ steps.dev-version.outputs.version }}
        run: |
          for package_dir in react-doctor oxlint-plugin-react-doctor eslint-plugin-react-doctor; do
            node -e "const fs = require('node:fs'); const path = 'packages/${package_dir}/package.json'; const manifest = JSON.parse(fs.readFileSync(path, 'utf8')); manifest.version = process.env.DEV_VERSION; fs.writeFileSync(path, JSON.stringify(manifest, null, 2) + '\n');"
          done

      - name: Build
        env:
          VERSION: ${{ steps.dev-version.outputs.version }}
        run: pnpm build

      # Inject Debug IDs into the built bundle and upload its source maps to
      # Sentry BEFORE publishing, so the @dev tarball symbolicates. No-op when
      # the SENTRY_* secrets aren't configured.
      - name: Upload source maps to Sentry (@dev)
        env:
          VERSION: ${{ steps.dev-version.outputs.version }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
        run: node scripts/sentry-sourcemaps.mjs

      - name: Publish to npm under the dev tag
        env:
          NPM_CONFIG_PROVENANCE: true
        run: |
          for attempt in 1 2 3; do
            if pnpm publish --recursive --tag dev --no-git-checks --access public; then
              exit 0
            fi
            backoff_seconds=$((attempt * 15))
            echo "Dev publish attempt ${attempt} failed; retrying in ${backoff_seconds}s (already-published versions are skipped by pnpm)"
            sleep "${backoff_seconds}"
          done
          echo "Dev publish failed after 3 attempts"
          exit 1