Files
lucide/.github/workflows/release.yml
T
Thibaud-Vdb 8298424ae0 ci: pass only the secret the release workflow needs
Both reusable calls to release.yml used 'secrets: inherit', which
forwards the caller's entire secret set. The only secret release.yml
reads is BLOB_READ_WRITE_TOKEN, used by the build-font job to upload
the code points blob; npm publishing is OIDC trusted publishing and
needs no token secret at all. Declare that one secret on the reusable
workflow and pass it explicitly, so the workflow files show exactly
which secret flows into the release path and nothing else does. It is
declared optional, so tag-push runs (which read it from the repo
secrets directly) and forks without the secret behave as before.
2026-08-05 11:05:42 +02:00

177 lines
5.5 KiB
YAML

name: Release Packages
on:
push:
tags:
- 'v*'
workflow_call:
inputs:
version:
required: true
description: Version
type: string
tag:
description: NPM tag
default: 'latest'
type: string
secrets:
BLOB_READ_WRITE_TOKEN:
description: Token used by build-font to upload the code points blob
required: false
permissions:
id-token: write # Required for OIDC
contents: write
jobs:
prepare:
if: github.repository == 'lucide-icons/lucide' && contains('["ericfennis", "karsa-mistmere", "jguddas"]', github.actor)
runs-on: ubuntu-latest
outputs:
VERSION: ${{ steps.get_version.outputs.VERSION }}
steps:
- name: Get the version
id: get_version
run: |
echo $VERSION_REF
echo "VERSION=${VERSION_REF/refs\/tags\/\v}" >> $GITHUB_OUTPUT
env:
VERSION_REF: ${{ inputs.version || github.event.inputs.version || github.ref }}
release:
if: github.repository == 'lucide-icons/lucide'
runs-on: ubuntu-latest
needs: prepare
permissions:
id-token: write # Required for OIDC
contents: read
strategy:
fail-fast: false
matrix:
package:
[
'lucide',
'lucide-react',
'lucide-react-native',
'lucide-preact',
'lucide-solid',
'@lucide/angular',
'@lucide/astro',
'@lucide/icons',
'@lucide/svelte',
'@lucide/vue',
]
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
cache: 'pnpm'
node-version-file: 'package.json'
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Set new version
run: pnpm version ${{ needs.prepare.outputs.VERSION }} --filter ${{ matrix.package }} --fail-if-no-match --no-git-tag-version
- name: Build
run: pnpm --filter ${{ matrix.package }} build
- name: Test
run: pnpm --filter ${{ matrix.package }} test
- name: Publish
run: pnpm --filter ${{ matrix.package }} publish --access public --no-git-checks --ignore-scripts --tag ${{ inputs.tag }}
env:
NPM_CONFIG_PROVENANCE: true
lucide-static:
if: github.repository == 'lucide-icons/lucide'
runs-on: ubuntu-latest
needs: [prepare, lucide-font]
permissions:
id-token: write # Required for OIDC
contents: read
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
cache: 'pnpm'
node-version-file: 'package.json'
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Set new version
run: pnpm version ${{ needs.prepare.outputs.VERSION }} --filter lucide-static --no-git-tag-version
- name: Move Font
run: cp -r lucide-font packages/lucide-static/font
- name: Build
run: pnpm --filter lucide-static build
- name: Publish
run: pnpm --filter lucide-static publish --no-git-checks --ignore-scripts --tag ${{ inputs.tag }} --access public
env:
NPM_CONFIG_PROVENANCE: true
lucide-font:
if: github.repository == 'lucide-icons/lucide'
runs-on: ubuntu-latest
needs: prepare
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
cache: 'pnpm'
node-version-file: 'package.json'
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Execute unit tests for build-font
run: pnpm test:font
- name: Create font in ./lucide-font
run: pnpm build:font --saveCodePoints
env:
BLOB_READ_WRITE_TOKEN: ${{ secrets.BLOB_READ_WRITE_TOKEN }}
- name: 'Upload to Artifacts'
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: lucide-font
path: lucide-font
post-release:
if: github.repository == 'lucide-icons/lucide' && github.event_name != 'workflow_call'
runs-on: ubuntu-latest
needs: [prepare, lucide-font]
permissions:
id-token: write # Required for OIDC
contents: write
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
- name: Zip font and icons
run: |
zip -r lucide-font-${{ needs.prepare.outputs.VERSION }}.zip lucide-font
zip -r lucide-icons-${{ needs.prepare.outputs.VERSION }}.zip icons
- name: Release zip and fonts
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
with:
tag_name: ${{ needs.prepare.outputs.VERSION }}
files: |
lucide-font-${{ needs.prepare.outputs.VERSION }}.zip
lucide-icons-${{ needs.prepare.outputs.VERSION }}.zip