security(deps): remediate pnpm audit vulnerabilities #103
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish prereleases | |
| on: | |
| push: | |
| branches: [main, experimental] | |
| pull_request: | |
| jobs: | |
| release: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| name: Publish builder package | |
| runs-on: ubuntu-latest | |
| # Skip PRs created by changesets/action (pattern: changeset-release/{branch}) | |
| if: github.event_name != 'pull_request' || !startsWith(github.event.pull_request.head.ref, 'changeset-release/') | |
| steps: | |
| - name: Checkout Repo | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Dependencies | |
| uses: ./.github/actions/install-dependencies | |
| - name: Setup git for changeset | |
| run: | | |
| # Fetch all remote refs | |
| git fetch origin --tags --force | |
| # Create local main branch pointing to origin/main | |
| # Changeset looks for local "main" branch, not origin/main | |
| # Only force update if main is not the current branch (to avoid worktree error) | |
| if [ "$(git branch --show-current)" != "main" ]; then | |
| git branch -f main origin/main | |
| fi | |
| - name: Detect changed packages | |
| id: changeset | |
| run: | | |
| # Run changeset status, but don't fail if there are no changesets | |
| # This allows the workflow to continue gracefully | |
| pnpm exec changeset status --output /tmp/status.json || true | |
| # Check if the status file was created | |
| if [ -f /tmp/status.json ]; then | |
| RELEASE_COUNT=$(jq '.releases | length' /tmp/status.json) | |
| else | |
| # If changeset failed (no changesets found), treat as 0 releases | |
| RELEASE_COUNT=0 | |
| echo '{}' > /tmp/status.json | |
| fi | |
| echo "release_count=$RELEASE_COUNT" >> $GITHUB_OUTPUT | |
| echo "Found $RELEASE_COUNT packages to release" | |
| - name: Build changed packages | |
| if: steps.changeset.outputs.release_count != '0' | |
| run: | | |
| # Parse packages from changeset status | |
| PACKAGES=$(jq -r '.releases[].name' /tmp/status.json) | |
| # Build filter arguments for pnpm | |
| FILTER_ARGS="" | |
| for PKG in $PACKAGES; do | |
| FILTER_ARGS="$FILTER_ARGS --filter \"$PKG...\"" | |
| done | |
| # Build all packages including their dependencies in correct order | |
| # The "..." syntax includes dependencies of the target packages | |
| eval "pnpm run compile $FILTER_ARGS" | |
| - name: Publish to pkg-pr-new | |
| if: steps.changeset.outputs.release_count != '0' | |
| run: | | |
| # Parse packages and build paths | |
| PACKAGES=$(jq -r '.releases[].name' /tmp/status.json | sed 's/@aziontech\///g') | |
| # Build publish command (removed --compact since packages aren't on npm yet) | |
| CMD="pnpm exec pkg-pr-new publish --pnpm" | |
| for PKG in $PACKAGES; do | |
| CMD="$CMD './packages/$PKG'" | |
| done | |
| echo "Running: $CMD" | |
| eval $CMD |