publish-on-npm.yml

name: Publish on NPM

on:
  release:
    types: [ published ]
  # Allow this workflow to be manually dispatched from the GitHub Actions UI or CLI
  # in order to manually create or retry releases. This should not be necessary most of the time, as
  # the 'on: release' trigger above should suffice.
  workflow_dispatch:

permissions:
  contents: read

jobs:
  publish-on-npm:
    runs-on: ubuntu-latest
    steps:
      # This action checks out at the commit of the tagged release.
      - uses: actions/3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      # Install all deps in preparation for creating a release.
      # Unlike publishing, this is done using the normal NPM registry
      # to download deps.
      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          node-version: current
      # TODO: We should check in a lockfile and use npm ci here instead.
      - run: npm install

      # Re-setup node using Wombat Dressing Room as the registry
      # The actual NodeJS binaries and such are cached, so doing this
      # twice isn't particularly expensive.
      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          node-version: current
          registry-url: https://wombat-dressing-room.appspot.com
      # Publish google-closure-library.
      - run: npm publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_GOOGLE_CLOSURE_LIBRARY }}
      # Publish google-closure-deps. Unlike google-closure-library, we do not
      # need to run `npm install` since there is no prepublish step.
      - run: npm publish
        working-directory: ./closure-deps
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_GOOGLE_CLOSURE_DEPS }}