mirror of
https://github.com/ether/etherpad-lite.git
synced 2026-07-17 16:47:05 +00:00
a698e34772
The releaseEtherpad workflow renames ep_etherpad-lite -> ep_etherpad and publishes ./src to npm, but that publish is not load-bearing: - `ep_etherpad` has 0 dependents on npm; nothing in this repo depends on it. - Plugins import `ep_etherpad-lite` resolved from the LOCAL core install, and plugin CI clones `ether/etherpad` rather than `npm install`-ing core. - Etherpad is run via git clone / Docker / zip / snap, never `npm install`. It has been failing with E404 (the ep_etherpad package has no OIDC trusted publisher configured on npmjs.com), which is why npm is stuck at 2.5.0 while 3.0/3.1/3.2/3.3 shipped fine without it. Rather than chase a trusted-publisher setup for a publish nobody consumes, park the workflow: gate the job behind an explicit `confirm: true` dispatch input so a stray run fails fast with a clear message instead of a confusing 404, and document the status in the header + the AGENTS.MD Releasing section. This is the package owner's (samtv12345) call: either finish the trusted- publisher config to revive it, or remove the workflow. Parked pending that decision; nothing about the release depends on it. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
81 lines
3.8 KiB
YAML
81 lines
3.8 KiB
YAML
# PARKED — npm publish of the core package is not part of the standard release.
|
|
#
|
|
# This workflow renames `ep_etherpad-lite` -> `ep_etherpad` and publishes
|
|
# `./src` to npm. As of 2026-06, that publish serves no load-bearing purpose:
|
|
# - `ep_etherpad` has 0 dependents on npm and nothing in this repo depends on it;
|
|
# - plugins import `ep_etherpad-lite` resolved from the LOCAL core install,
|
|
# and plugin CI clones `ether/etherpad` rather than `npm install`-ing core;
|
|
# - Etherpad is run via git clone / Docker / zip / snap, never `npm install`.
|
|
# The publish has been failing (E404 PUT — the `ep_etherpad` package has no OIDC
|
|
# trusted publisher configured on npmjs.com), which is why npm is stuck at 2.5.0
|
|
# while 3.x shipped fine without it.
|
|
#
|
|
# It is therefore gated behind an explicit `confirm: true` dispatch input so a
|
|
# stray run fails fast with a clear message instead of a confusing 404. To
|
|
# actually publish, the npm owner of `ep_etherpad` (samtv12345) must first
|
|
# configure a trusted publisher: npmjs.com -> ep_etherpad -> Settings ->
|
|
# Trusted Publisher -> repo `ether/etherpad`, workflow `releaseEtherpad.yml`.
|
|
# Decision pending: finish that config, or remove this workflow. See AGENTS.MD.
|
|
name: releaseEtherpad.yaml
|
|
permissions:
|
|
contents: read
|
|
id-token: write # for npm OIDC trusted publishing
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
confirm:
|
|
description: 'PARKED — publish ep_etherpad to npm? Requires a trusted publisher configured on npmjs.com first (see workflow header). Set true only if that is done.'
|
|
required: true
|
|
default: false
|
|
type: boolean
|
|
|
|
env:
|
|
PNPM_HOME: ~/.pnpm-store
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Guard — refuse unless explicitly confirmed
|
|
if: ${{ inputs.confirm != true }}
|
|
run: |
|
|
echo "::error::releaseEtherpad is PARKED. The ep_etherpad npm publish is non-functional"
|
|
echo "::error::(no trusted publisher configured on npmjs.com; 0 dependents on npm)."
|
|
echo "::error::Re-run with confirm=true only after the owner configures a trusted"
|
|
echo "::error::publisher. See the workflow header / AGENTS.MD 'Releasing' section."
|
|
exit 1
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v6
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
# OIDC trusted publishing needs npm >= 11.5.1, which requires
|
|
# Node >= 22.9.0. Node 24 satisfies that and matches the rest of CI.
|
|
node-version: 24
|
|
registry-url: https://registry.npmjs.org/
|
|
- name: Upgrade npm to >=11.5.1 (required for trusted publishing)
|
|
run: npm install -g npm@latest
|
|
- uses: actions/cache@v5
|
|
name: Cache pnpm store
|
|
with:
|
|
path: ${{ env.PNPM_HOME }}
|
|
key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-pnpm-store-
|
|
- uses: pnpm/action-setup@v6
|
|
name: Install pnpm
|
|
with:
|
|
run_install: false
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Rename etherpad
|
|
working-directory: ./src
|
|
run: sed -i 's/ep_etherpad-lite/ep_etherpad/g' package.json
|
|
# Use `npm publish` directly (not the `pnpm` wrapper) because OIDC
|
|
# trusted publishing requires npm CLI >= 11.5.1 and the wrapper shells
|
|
# out to npm; calling npm directly avoids any shim ambiguity. The
|
|
# ep_etherpad package must have a trusted publisher configured on
|
|
# npmjs.com pointing at this workflow file. See:
|
|
# https://docs.npmjs.com/trusted-publishers
|
|
- name: Release to npm via OIDC
|
|
run: npm publish --provenance --access public
|
|
working-directory: ./src
|