From 1e10473fb7521fd0b48af283858457ac0067d4d0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9E=97=E5=87=AF90331?= <90331@sangfor.com> Date: Thu, 14 May 2026 21:37:15 +0800 Subject: [PATCH] ci(publish-npm): pin bun version, add vite build, and ignore scripts on publish MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pin bun to 1.3.11 for reproducible builds. Add explicit vite build step before publishing. Add --ignore-scripts to npm publish for security. Signed-off-by: 林凯90331 <90331@sangfor.com> Co-authored-by: CoStrict --- .github/workflows/publish-npm.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index b135983b4..6436fccce 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -88,7 +88,7 @@ jobs: - name: Setup Bun uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2, 2026-04-25 with: - bun-version: latest + bun-version: "1.3.11" - name: Setup SSH for review agent generation uses: webfactory/ssh-agent@v0.9.0 @@ -107,15 +107,18 @@ jobs: # - name: Run tests # run: bun test + - name: Build for publish (Vite) + run: bun run build:vite + - name: Publish to npm if: ${{ github.event.inputs.dry_run != 'true' }} - run: npm publish --provenance --access public + run: npm publish --provenance --access public --ignore-scripts env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Publish to npm (dry-run) if: ${{ github.event.inputs.dry_run == 'true' }} - run: npm publish --dry-run --provenance --access public + run: npm publish --dry-run --provenance --access public --ignore-scripts env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}