publish-npm-prerelease.yml

name: 🏷️ Publish NPM prerelease

on:
  workflow_dispatch:
    inputs:
      bump:
        type: choice
        description: Bump
        options:
          - prepatch
          - preminor
          - premajor
          - prerelease
          - auto
      tag:
        type: choice
        description: Tag
        options:
          - alpha
          - beta
          - next
      dryrun:
        type: boolean
        required: false
        description: Dry-Run

permissions:
  contents: write
  id-token: write

jobs:
  deploy-npm-prerelease:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Retrieve current Date Time in EST
        shell: bash
        run: echo "START_TIME=$(TZ=":America/New_York" date -R|sed 's/.....$//')" >> $GITHUB_ENV

      - name: Current datetime - ${{ env.START_TIME }}
        run: echo ${{ env.START_TIME }}

      - name: Clone repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - if: ${{ github.event.pull_request.merged != true && contains('["ghiscoding"]', github.actor) != true }}
        name: Ensure current actor is allowed to run the workflow
        run: |
          echo "Error: Your GitHub username (${{ github.actor }}) is not on the allowed list of admins for this workflow"
          exit 1

      - name: Set NodeJS
        uses: actions/setup-node@v4
        with:
          registry-url: 'https://registry.npmjs.org/'
          node-version: 20

      - name: Install pnpm
        uses: pnpm/action-setup@v2
        with:
          version: 8
          run_install: false

      - name: Get pnpm store directory
        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@v3
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Run pnpm install dependencies
        run: pnpm install

      - name: Build Library
        run: pnpm bundle

      - name: Archive common build artifacts
        if: ${{ inputs.dryrun != true }}
        uses: actions/upload-artifact@v3
        with:
          name: dist-common
          path: |
            packages/common/dist
          retention-days: 5

      - name: 🧪 Lerna Version auto-bump (dry-run) 🏷️
        if: ${{ inputs.dryrun == true && inputs.bump == 'auto' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          git config --global user.name "${{ github.actor }}"
          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
          pnpm whoami
          pnpm exec lerna version --conventional-commits --conventional-prerelease --dry-run --preid ${{ inputs.tag }} --force-publish --yes

      - name: 🧪 Lerna Version with selected pre-bump (dry-run) 🏷️
        if: ${{ inputs.dryrun == true && inputs.bump != 'auto' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          git config --global user.name "${{ github.actor }}"
          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
          pnpm whoami
          pnpm exec lerna version ${{ inputs.bump }} --conventional-commits --conventional-prerelease --dry-run --preid ${{ inputs.tag }} --force-publish --yes

      - name: 🧪 Lerna Publish (dry-run) 📦
        if: ${{ inputs.dryrun == true }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          pnpm exec lerna publish from-package --force-publish --dist-tag ${{ inputs.tag }} --yes --dry-run

      - name: Lerna Version auto-bump 🏷️
        if: ${{ inputs.dryrun != true && inputs.bump == 'auto' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          git config --global user.name "${{ github.actor }}"
          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
          pnpm whoami
          pnpm exec lerna version --conventional-commits --conventional-prerelease --preid ${{ inputs.tag }} --force-publish --yes

      - name: Lerna Version with selected pre-bump 🏷️
        if: ${{ inputs.dryrun != true && inputs.bump != 'auto' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          git config --global user.name "${{ github.actor }}"
          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
          pnpm whoami
          pnpm exec lerna version ${{ inputs.bump }} --conventional-commits --conventional-prerelease --preid ${{ inputs.tag }} --force-publish --yes

      - name: OTP
        if: ${{ inputs.dryrun != true }}
        uses: step-security/wait-for-secrets@v1
        id: wait-for-secrets
        with:
          secrets: |
            OTP:
              name: 'OTP to publish package'
              description: 'OTP from authenticator app'

      - name: Lerna Publish 📦
        if: ${{ inputs.dryrun != true }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          pnpm exec lerna publish from-package --force-publish --dist-tag ${{ inputs.tag }} --yes --otp ${{ steps.wait-for-secrets.outputs.OTP }}