publish.yml

name: publish

on:
  workflow_dispatch:
  release:
    types: [published]

jobs:
  main:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - run: corepack enable

      - uses: actions/setup-node@v4
        with:
          node-version-file: package.json
          cache: 'pnpm'
          cache-dependency-path: 'pnpm-lock.yaml'

      - run: pnpm whoami && echo 'npm credentials are valid' || (echo 'npm credentials are invalid or have expired.' && exit 1)
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}

      - uses: nrwl/nx-set-shas@v4

      - run: pnpm i

      - run: pnpm exec nx report

      - run: pnpm exec nx release publish --dry-run=${{ env.DRY_RUN }}
        env:
          DRY_RUN: true
          # DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && 'true' || 'false' }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
          NPM_CONFIG_PROVENANCE: true