name: 📦 publish (reusable)

# Reusable package-publish workflow. Auto-detects the ecosystem and publishes

# to the matching registry, then attaches build artifacts to the GitHub Release.

# Intended to be chained after release-please.yml in the same run:

#

# jobs:

# release:

# uses: bamr87/.github/.github/workflows/release-please.yml@main

# publish:

# needs: release

# if: needs.release.outputs.release_created == 'true'

# uses: bamr87/.github/.github/workflows/publish.yml@main

# with:

# tag: ${{ needs.release.outputs.tag_name }}

# version: ${{ needs.release.outputs.version }}

# secrets: inherit

#

# A registry job is a no-op (skipped) when that ecosystem isn't detected, and

# fails loudly only when the ecosystem IS present but its credential is missing.

on:

workflow_call:

inputs:

tag:

type: string

required: true

version:

type: string

required: true

secrets:

RUBYGEMS_API_KEY:

required: false

NPM_TOKEN:

required: false

permissions:

contents: read

defaults:

run:

shell: bash

jobs:

detect:

name: 🔍 Detect targets

runs-on: ubuntu-latest

outputs:

gem: ${{ steps.s.outputs.gem }}

node: ${{ steps.s.outputs.node }}

python: ${{ steps.s.outputs.python }}

docker: ${{ steps.s.outputs.docker }}

registry: ${{ steps.s.outputs.registry }}

steps:

- uses: actions/checkout@v4

- id: s

uses: bamr87/.github/.github/actions/detect-stack@main

gem:

name: 💎 RubyGems

needs: detect

if: needs.detect.outputs.gem == 'true'

runs-on: ubuntu-latest

permissions:

contents: write

steps:

- uses: actions/checkout@v4

- uses: ruby/setup-ruby@v1

with:

ruby-version: "3.3"

# Intentionally NOT bundler-cache:true — that runs a *frozen* bundle

# install, which fails at release time whenever a gemspec/path-gem

# version bump hasn't been re-locked ("the gemspecs for path gems

# changed, but the lockfile can't be updated because frozen mode is

# set"). release-please bumps version.rb but not Gemfile.lock, so the

# lock is stale by definition on the release commit. gem build needs

# no bundle; the non-frozen install below just keeps deps available.

bundler-cache: false

- name: Install deps (non-frozen — tolerate release-time version bump)

run: |

if [[ -f Gemfile ]]; then

bundle config set --local frozen false

bundle install --jobs 4

fi

- name: Guard credential

run: |

if [[ -z "${{ secrets.RUBYGEMS_API_KEY }}" ]]; then

echo "::error title=Missing RUBYGEMS_API_KEY::Add the secret to publish the gem."; exit 1

fi

- name: Build gem

run: |

if [[ -x scripts/build ]]; then ./scripts/build; else gem build ./*.gemspec; fi

ls -la ./*.gem

- name: Publish to RubyGems

env:

GEM_HOST_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }}

run: gem push ./*.gem

- name: Attach assets to release

env:

GH_TOKEN: ${{ github.token }}

run: |

assets=(./*.gem)

[[ -f install.sh ]] && assets+=(install.sh)

gh release upload "${{ inputs.tag }}" "${assets[@]}" --clobber

npm:

name: 📦 npm

needs: detect

if: needs.detect.outputs.registry == 'npm'

runs-on: ubuntu-latest

permissions:

contents: read

id-token: write # npm provenance

steps:

- uses: actions/checkout@v4

- uses: actions/setup-node@v4

with:

node-version: "20"

registry-url: "https://registry.npmjs.org"

- name: Guard credential

run: |

if [[ -z "${{ secrets.NPM_TOKEN }}" ]]; then

echo "::error title=Missing NPM_TOKEN::Add the secret to publish to npm."; exit 1

fi

- run: npm ci || npm install

- run: npm run build --if-present

- name: Publish to npm

env:

NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

run: npm publish --provenance --access public

pypi:

name: 🐍 PyPI

needs: detect

if: needs.detect.outputs.python == 'true'

runs-on: ubuntu-latest

permissions:

id-token: write # PyPI trusted publishing (OIDC) — no token needed

steps:

- uses: actions/checkout@v4

- uses: actions/setup-python@v5

with:

python-version: "3.12"

- name: Build distributions

run: |

python -m pip install --upgrade pip build

python -m build

- name: Publish to PyPI (trusted publishing)

uses: pypa/gh-action-pypi-publish@release/v1

with:

skip-existing: true

ghcr:

name: 🐳 GHCR

needs: detect

if: needs.detect.outputs.docker == 'true'

runs-on: ubuntu-latest

permissions:

contents: read

packages: write

steps:

- uses: actions/checkout@v4

- uses: docker/setup-buildx-action@v3

- uses: docker/login-action@v3

with:

registry: ghcr.io

username: ${{ github.actor }}

password: ${{ github.token }}

- name: Image metadata

id: meta

run: |

repo="ghcr.io/${GITHUB_REPOSITORY,,}"

echo "tags=${repo}:${{ inputs.version }},${repo}:latest" >> "$GITHUB_OUTPUT"

- uses: docker/build-push-action@v6

with:

context: .

push: true

tags: ${{ steps.meta.outputs.tags }}

platforms: linux/amd64,linux/arm64