mirror of
https://github.com/lucide-icons/lucide.git
synced 2026-11-14 13:58:21 +00:00
Both reusable calls to release.yml used 'secrets: inherit', which forwards the caller's entire secret set. The only secret release.yml reads is BLOB_READ_WRITE_TOKEN, used by the build-font job to upload the code points blob; npm publishing is OIDC trusted publishing and needs no token secret at all. Declare that one secret on the reusable workflow and pass it explicitly, so the workflow files show exactly which secret flows into the release path and nothing else does. It is declared optional, so tag-push runs (which read it from the repo secrets directly) and forks without the secret behave as before.
177 lines
5.5 KiB
YAML
177 lines
5.5 KiB
YAML
name: Release Packages
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
workflow_call:
|
|
inputs:
|
|
version:
|
|
required: true
|
|
description: Version
|
|
type: string
|
|
tag:
|
|
description: NPM tag
|
|
default: 'latest'
|
|
type: string
|
|
secrets:
|
|
BLOB_READ_WRITE_TOKEN:
|
|
description: Token used by build-font to upload the code points blob
|
|
required: false
|
|
|
|
permissions:
|
|
id-token: write # Required for OIDC
|
|
contents: write
|
|
|
|
jobs:
|
|
prepare:
|
|
if: github.repository == 'lucide-icons/lucide' && contains('["ericfennis", "karsa-mistmere", "jguddas"]', github.actor)
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
VERSION: ${{ steps.get_version.outputs.VERSION }}
|
|
|
|
steps:
|
|
- name: Get the version
|
|
id: get_version
|
|
run: |
|
|
echo $VERSION_REF
|
|
echo "VERSION=${VERSION_REF/refs\/tags\/\v}" >> $GITHUB_OUTPUT
|
|
env:
|
|
VERSION_REF: ${{ inputs.version || github.event.inputs.version || github.ref }}
|
|
|
|
release:
|
|
if: github.repository == 'lucide-icons/lucide'
|
|
runs-on: ubuntu-latest
|
|
needs: prepare
|
|
permissions:
|
|
id-token: write # Required for OIDC
|
|
contents: read
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
package:
|
|
[
|
|
'lucide',
|
|
'lucide-react',
|
|
'lucide-react-native',
|
|
'lucide-preact',
|
|
'lucide-solid',
|
|
'@lucide/angular',
|
|
'@lucide/astro',
|
|
'@lucide/icons',
|
|
'@lucide/svelte',
|
|
'@lucide/vue',
|
|
]
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
|
|
with:
|
|
cache: 'pnpm'
|
|
node-version-file: 'package.json'
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Set new version
|
|
run: pnpm version ${{ needs.prepare.outputs.VERSION }} --filter ${{ matrix.package }} --fail-if-no-match --no-git-tag-version
|
|
|
|
- name: Build
|
|
run: pnpm --filter ${{ matrix.package }} build
|
|
|
|
- name: Test
|
|
run: pnpm --filter ${{ matrix.package }} test
|
|
|
|
- name: Publish
|
|
run: pnpm --filter ${{ matrix.package }} publish --access public --no-git-checks --ignore-scripts --tag ${{ inputs.tag }}
|
|
env:
|
|
NPM_CONFIG_PROVENANCE: true
|
|
|
|
lucide-static:
|
|
if: github.repository == 'lucide-icons/lucide'
|
|
runs-on: ubuntu-latest
|
|
needs: [prepare, lucide-font]
|
|
permissions:
|
|
id-token: write # Required for OIDC
|
|
contents: read
|
|
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
|
|
with:
|
|
cache: 'pnpm'
|
|
node-version-file: 'package.json'
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Set new version
|
|
run: pnpm version ${{ needs.prepare.outputs.VERSION }} --filter lucide-static --no-git-tag-version
|
|
|
|
- name: Move Font
|
|
run: cp -r lucide-font packages/lucide-static/font
|
|
|
|
- name: Build
|
|
run: pnpm --filter lucide-static build
|
|
|
|
- name: Publish
|
|
run: pnpm --filter lucide-static publish --no-git-checks --ignore-scripts --tag ${{ inputs.tag }} --access public
|
|
env:
|
|
NPM_CONFIG_PROVENANCE: true
|
|
|
|
lucide-font:
|
|
if: github.repository == 'lucide-icons/lucide'
|
|
runs-on: ubuntu-latest
|
|
needs: prepare
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
|
|
with:
|
|
cache: 'pnpm'
|
|
node-version-file: 'package.json'
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Execute unit tests for build-font
|
|
run: pnpm test:font
|
|
|
|
- name: Create font in ./lucide-font
|
|
run: pnpm build:font --saveCodePoints
|
|
env:
|
|
BLOB_READ_WRITE_TOKEN: ${{ secrets.BLOB_READ_WRITE_TOKEN }}
|
|
|
|
- name: 'Upload to Artifacts'
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: lucide-font
|
|
path: lucide-font
|
|
|
|
post-release:
|
|
if: github.repository == 'lucide-icons/lucide' && github.event_name != 'workflow_call'
|
|
runs-on: ubuntu-latest
|
|
needs: [prepare, lucide-font]
|
|
permissions:
|
|
id-token: write # Required for OIDC
|
|
contents: write
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
- name: Zip font and icons
|
|
run: |
|
|
zip -r lucide-font-${{ needs.prepare.outputs.VERSION }}.zip lucide-font
|
|
zip -r lucide-icons-${{ needs.prepare.outputs.VERSION }}.zip icons
|
|
|
|
- name: Release zip and fonts
|
|
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
|
|
with:
|
|
tag_name: ${{ needs.prepare.outputs.VERSION }}
|
|
|
|
files: |
|
|
lucide-font-${{ needs.prepare.outputs.VERSION }}.zip
|
|
lucide-icons-${{ needs.prepare.outputs.VERSION }}.zip
|