mirror of
https://github.com/lucide-icons/lucide.git
synced 2026-11-14 13:58:21 +00:00
Thibaud-Vdb
8298424ae0
Both reusable calls to release.yml used 'secrets: inherit', which forwards the caller's entire secret set. The only secret release.yml reads is BLOB_READ_WRITE_TOKEN, used by the build-font job to upload the code points blob; npm publishing is OIDC trusted publishing and needs no token secret at all. Declare that one secret on the reusable workflow and pass it explicitly, so the workflow files show exactly which secret flows into the release path and nothing else does. It is declared optional, so tag-push runs (which read it from the repo secrets directly) and forks without the secret behave as before.
126 lines
3.9 KiB
YAML
126 lines
3.9 KiB
YAML
name: Continuous integration icons
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- icons/**/*.svg
|
|
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: Version
|
|
required: true
|
|
tag:
|
|
required: true
|
|
description: NPM tag
|
|
default: 'latest'
|
|
type: choice
|
|
options:
|
|
- latest
|
|
- next
|
|
- beta
|
|
- alpha
|
|
|
|
permissions:
|
|
id-token: write # Required for OIDC
|
|
contents: write
|
|
|
|
jobs:
|
|
check-dispatch-gate:
|
|
if: github.repository == 'lucide-icons/lucide' &&
|
|
startsWith(github.event.head_commit.message, 'feat(icons)') &&
|
|
github.event_name != 'workflow_dispatch'
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
RELEASE_ENVIRONMENT: ${{ steps.environment.outputs.RELEASE_ENVIRONMENT }}
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
|
|
- name: Fetch tags
|
|
run: git fetch --all --tags
|
|
|
|
- name: Check if latest tag was created today
|
|
id: environment
|
|
run: |
|
|
LATEST_TAG=$(git tag --sort=-v:refname | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | head -n 1)
|
|
TAG_DATE=$(git log -1 --format=%cs "$LATEST_TAG")
|
|
TODAY=$(date +%Y-%m-%d)
|
|
|
|
if [ "$TAG_DATE" == "$TODAY" ]; then
|
|
echo "::warning::A release tag already exists for today ($TODAY): $LATEST_TAG. Manual approval will be required to proceed."
|
|
echo "RELEASE_ENVIRONMENT=Icon Release Gated" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "RELEASE_ENVIRONMENT=Icon Release" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
create-release:
|
|
if: github.repository == 'lucide-icons/lucide'
|
|
needs: check-dispatch-gate
|
|
environment: ${{ needs.check-dispatch-gate.outputs.RELEASE_ENVIRONMENT }}
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
VERSION: ${{ steps.new-version.outputs.NEW_VERSION }}
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
|
|
with:
|
|
cache: 'pnpm'
|
|
node-version-file: 'package.json'
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Fetch tags
|
|
run: git fetch --all --tags
|
|
|
|
- name: Get latest tag
|
|
id: latest-tag
|
|
run: echo "LATEST_TAG=$(git tag --sort=-v:refname | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | head -n 1)" >> $GITHUB_OUTPUT
|
|
|
|
- name: Log latest tag
|
|
run: echo '${{ steps.latest-tag.outputs.LATEST_TAG }}'
|
|
|
|
- name: Check if we can patch
|
|
run: pnpm semver $LATEST_TAG -i minor
|
|
env:
|
|
LATEST_TAG: ${{ steps.latest-tag.outputs.LATEST_TAG }}
|
|
|
|
- name: Create new version
|
|
id: new-version
|
|
run: echo "NEW_VERSION=$(pnpm semver $LATEST_TAG -i minor)" >> $GITHUB_OUTPUT
|
|
env:
|
|
LATEST_TAG: ${{ steps.latest-tag.outputs.LATEST_TAG }}
|
|
|
|
- name: Check output
|
|
run: |
|
|
echo '${{ steps.new-version.outputs.NEW_VERSION }}'
|
|
echo '${{ steps.change-log.outputs.CHANGE_LOG }}'
|
|
|
|
- name: Create Release
|
|
uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
|
|
with:
|
|
tag_name: ${{ steps.new-version.outputs.NEW_VERSION }}
|
|
name: Version ${{ steps.new-version.outputs.NEW_VERSION }}
|
|
generate_release_notes: true
|
|
|
|
start-release:
|
|
if: github.repository == 'lucide-icons/lucide'
|
|
needs: create-release
|
|
uses: './.github/workflows/release.yml'
|
|
secrets:
|
|
BLOB_READ_WRITE_TOKEN: ${{ secrets.BLOB_READ_WRITE_TOKEN }}
|
|
with:
|
|
version: ${{ needs.create-release.outputs.VERSION }}
|
|
|
|
dispatch-release:
|
|
if: github.event_name == 'workflow_dispatch'
|
|
uses: './.github/workflows/release.yml'
|
|
secrets:
|
|
BLOB_READ_WRITE_TOKEN: ${{ secrets.BLOB_READ_WRITE_TOKEN }}
|
|
with:
|
|
version: ${{ inputs.version }}
|
|
tag: ${{ inputs.tag }}
|