publish-prod.yml

"jobs":
  "yarn-publish":
    "container":
      "image": "mirror.gcr.io/node:18"
    "permissions":
      "contents": "read"
      "packages": "write"
      "pull-requests": "read"
    "runs-on": "ubuntu-latest"
    "steps":
    - "id": "check-binaries"
      "name": "check for ssh/git binaries"
      "run": |
        if command -v git;
          then
            echo "gitBinaryExists=true" >> $GITHUB_OUTPUT;
            echo "Git binary exists";
          else
            echo "Attempt to install git binary";
            if command -v apk; then
              echo "apk exists";
              apk add git && echo "gitBinaryExists=true" >> $GITHUB_OUTPUT;
            elif command -v apt; then
              echo "apt exists";
              apt update && apt install -y git && echo "gitBinaryExists=true" >> $GITHUB_OUTPUT;
            else
              echo "No package manager found, unable to install git cli binary";
              echo "gitBinaryExists=false" >> $GITHUB_OUTPUT;
            fi;
        fi;
        
        if command -v ssh;
          then
            echo "sshBinaryExists=true" >> $GITHUB_OUTPUT;
            echo "SSH binary exists";
            exit 0;
          else
            echo "Attempt to install ssh binary";
            if command -v apk; then
              echo "apk exists";
              apk add openssh-client && echo "sshBinaryExists=true" >> $GITHUB_OUTPUT && exit 0;
            elif command -v apt; then
              echo "apt exists";
              apt update && apt install -y openssh-client && echo "sshBinaryExists=true" >> $GITHUB_OUTPUT && exit 0;
            else
              echo "No package manager found, unable to install ssh cli binary";
              echo "sshBinaryExists=false" >> $GITHUB_OUTPUT;
            fi;
        fi;
        echo "sshBinaryExists=false" >> $GITHUB_OUTPUT;
    - "if": "${{  ( steps.check-binaries.outputs.sshBinaryExists == 'true' && steps.check-binaries.outputs.gitBinaryExists == 'true' ) }}"
      "name": "Check out repository code via ssh"
      "uses": "actions/checkout@v4"
      "with":
        "ref": "${{ github.sha }}"
        "ssh-key": "${{ secrets.VIRKO_GITHUB_SSH_KEY }}"
    - "if": "${{  ( steps.check-binaries.outputs.sshBinaryExists == 'false' || steps.check-binaries.outputs.gitBinaryExists == 'false' ) }}"
      "name": "Check out repository code via https"
      "uses": "actions/checkout@v4"
      "with":
        "ref": "${{ github.sha }}"
    - "name": "git safe directory"
      "run": "command -v git && git config --global --add safe.directory '*' || true"
    - "env":
        "NPM_TOKEN": "${{ secrets.npm_token }}"
      "name": "set gynzy npm_token"
      "run": |
        cat <<EOF > .npmrc
        registry=https://npm.gynzy.net/
        always-auth="true"
        "//npm.gynzy.net/:_authToken"="${NPM_TOKEN}"
        EOF
    - "name": "yarn"
      "run": "yarn --cache-folder .yarncache --frozen-lockfile --prefer-offline || yarn --cache-folder .yarncache --frozen-lockfile --prefer-offline"
    - "name": "build"
      "run": "yarn build"
    - "env":
        "NPM_TOKEN": "${{ secrets.npm_token }}"
      "name": "set gynzy npm_token"
      "run": |
        cat <<EOF > .npmrc
        registry=https://npm.gynzy.net/
        always-auth="true"
        "//npm.gynzy.net/:_authToken"="${NPM_TOKEN}"
        EOF
    - "env": {}
      "name": "publish"
      "run": |
        bash -c 'set -xeo pipefail;
        
        cp package.json package.json.bak;
        
        VERSION=$(yarn version --non-interactive 2>/dev/null | grep "Current version" | grep -o -P '[0-9a-zA-Z_.-]+$' );
        if [[ ! -z "${PR_NUMBER}" ]]; then
          echo "Setting tag/version for pr build.";
          TAG=pr-$PR_NUMBER;
          PUBLISHVERSION="$VERSION-pr$PR_NUMBER.$GITHUB_RUN_NUMBER";
        elif [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
          if [[ "${GITHUB_REF_NAME}" != "${VERSION}" ]]; then
            echo "Tag version does not match package version. They should match. Exiting";
            exit 1;
          fi
          echo "Setting tag/version for release/tag build.";
          PUBLISHVERSION=$VERSION;
          TAG="latest";
        elif [[ "${GITHUB_REF_TYPE}" == "branch" && ( "${GITHUB_REF_NAME}" == "main" || "${GITHUB_REF_NAME}" == "master" ) ]] || [[ "${GITHUB_EVENT_NAME}" == "deployment" ]]; then
          echo "Setting tag/version for release/tag build.";
          PUBLISHVERSION=$VERSION;
          TAG="latest";
        else
          exit 1
        fi
        
        yarn publish --non-interactive --no-git-tag-version --tag "$TAG" --new-version "$PUBLISHVERSION";
        
        mv package.json.bak package.json;
        ';
    "timeout-minutes": 30
"name": "publish-prod"
"on":
  "push":
    "branches":
    - "master"