Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
117 changes: 89 additions & 28 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -19,20 +19,52 @@ on:
type: boolean
description: "Publish to JSR?"
required: false
default: false
default: true
publish-npm:
type: boolean
description: "Publish to NPM?"
required: false
default: false
default: true
publish-gpr:
type: boolean
description: "Publish to GPR?"
required: false
default: true
Comment on lines +22 to +32
Copy link

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changing the default values for publish-jsr, publish-npm, and publish-gpr from false to true means that manually triggered workflows will now publish to all registries by default, unless explicitly disabled. This is a significant behavioral change that increases the risk of accidental publications. Consider whether this is the intended behavior or if it would be safer to keep the defaults as false and require explicit opt-in for publications.

Copilot uses AI. Check for mistakes.
release:
type: boolean
description: "Create a new GitHub Release?"
required: false
default: false
release-title:
type: string
description: |
Release title template ('{0}' -> $GITHUB_REF_NAME)
required: false
default: "{0}"
release-tag:
type: string
description: |
Git tag to create the release for ('{0}' -> $GITHUB_REF_NAME)
required: false
default: "{0}"
release-draft:
type: boolean
description: "Should the release be a draft?"
required: false
default: false
release-discussion-category:
type: string
description: "Discussion category for announcing new Releases"
required: false
default: "Releases"
release-assets:
type: string
description: "Glob pattern for assets to attach to the Release"
required: false

jobs:
check:
if: github.event.inputs.check == 'true' || github.event_name != 'workflow_dispatch'
if: inputs.check == 'true' || github.event_name != 'workflow_dispatch'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
Expand All @@ -44,36 +76,57 @@ jobs:
- id: ok
run: deno task ok

- if: success()
run: |
if [ -d .coverage ]; then
cp -r .coverage coverage
else
exit 1
fi
Comment on lines +79 to +85
Copy link

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The step copies .coverage to coverage and then exits with code 1 if .coverage doesn't exist. This will cause the entire workflow to fail if the directory is missing. However, the subsequent steps have continue-on-error: true (lines 89, 97), suggesting failures should be tolerated. Consider adding continue-on-error: true to this step as well, or removing the exit 1 to allow the workflow to proceed gracefully when coverage data is unavailable.

Copilot uses AI. Check for mistakes.

- id: coveralls
if: success()
continue-on-error: true
uses: coverallsapp/github-action@v2
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
file: .coverage/lcov.info

- id: coverage
if: success()
continue-on-error: true
uses: actions/upload-artifact@v6
with:
path: .coverage
path: coverage
name: nberlette-math-coverage_${{ github.ref_name }}-${{ github.sha }}

publish:
if: |
(github.event_name == 'push' &&
startsWith(github.ref, 'refs/tags/') &&
needs.check.result == 'success') ||
(github.event_name == 'workflow_dispatch' && (
github.event.inputs.publish-jsr == 'true' ||
github.event.inputs.publish-npm == 'true' ||
github.event.inputs.publish-gpr == 'true'
) && (needs.check.result == 'success' || github.event.inputs.check == 'false'))
inputs.publish-jsr == 'true' ||
inputs.publish-npm == 'true' ||
inputs.publish-gpr == 'true'
) && (needs.check.result == 'success' || inputs.check == 'false'))
runs-on: ubuntu-latest
needs: check
permissions:
contents: read
contents: write
id-token: write
packages: write
concurrency:
cancel-in-progress: true
group: publish-${{ github.ref_name }}
env:
IS_TAG: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') }}
IS_DISPATCHED: ${{ github.event_name == 'workflow_dispatch' }}
PUBLISH_JSR: ${{ (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') && needs.check.result == 'success') || (github.event_name == 'workflow_dispatch' && inputs.publish-jsr == 'true') }}
PUBLISH_NPM: ${{ (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') && needs.check.result == 'success') || (github.event_name == 'workflow_dispatch' && inputs.publish-npm == 'true') }}
PUBLISH_GPR: ${{ (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') && needs.check.result == 'success') || (github.event_name == 'workflow_dispatch' && inputs.publish-gpr == 'true') }}
RELEASE_TITLE: ${{ format(inputs.release-title || '{0}', github.ref_name) }}
RELEASE_TAG: ${{ format(inputs.release-tag || '{0}', github.ref_name) }}
steps:
- uses: actions/checkout@v6

Expand All @@ -82,48 +135,40 @@ jobs:
with:
deno-version: v2.x

- if: |
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
(github.event_name == 'workflow_dispatch' && github.event.inputs.publish-jsr == 'true')
- if: env.PUBLISH_JSR
name: "publish to jsr"
continue-on-error: true
run: deno publish

- if: |
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
(github.event_name == 'workflow_dispatch' && github.event.inputs.publish-npm == 'true')
- if: env.PUBLISH_NPM
name: "setup node for npm"
uses: actions/setup-node@v6
with:
node-version: 24
registry-url: "https://registry.npmjs.org"

- id: build
if: |
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
(github.event_name == 'workflow_dispatch' && (github.event.inputs.publish-npm == 'true' ||
github.event.inputs.publish-gpr == 'true'))
if: env.PUBLISH_NPM || env.PUBLISH_GPR
name: "build for npm"
run: deno task build
env:
NO_PUBLISH: 1

- id: artifact
if: steps.build.outcome == 'success'
continue-on-error: true
uses: actions/upload-artifact@v6
with:
path: npm
name: nberlette-math-npm_${{ github.ref_name }}-${{ github.sha }}

- if: |
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
(github.event_name == 'workflow_dispatch' && github.event.inputs.publish-npm == 'true')
- if: env.PUBLISH_NPM
name: "publish to npm"
continue-on-error: true
run: npm publish --access public
working-directory: npm

- if: |
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
(github.event_name == 'workflow_dispatch' && github.event.inputs.publish-gpr == 'true')
- if: env.PUBLISH_GPR
name: "setup node for gpr"
uses: actions/setup-node@v6
with:
Expand All @@ -132,12 +177,28 @@ jobs:
env:
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- if: |
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
(github.event_name == 'workflow_dispatch' && github.event.inputs.publish-gpr == 'true')
- if: env.PUBLISH_GPR
name: "publish to gpr"
env:
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_TOKEN: ${{ secrets.GITHUB_TOKEN }}
continue-on-error: true
working-directory: npm
run: npm publish --access public --registry https://npm.pkg.github.com

- if: inputs.release != 'false' && (env.IS_TAG || github.ref_type == 'tag')
Copy link

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The conditional expression inputs.release != 'false' is checking if the boolean input is not equal to the string 'false'. Since inputs.release is defined as a boolean type (line 34), this comparison will always be true because a boolean value will never equal the string 'false'. The correct check should be inputs.release == true or simply inputs.release.

Suggested change
- if: inputs.release != 'false' && (env.IS_TAG || github.ref_type == 'tag')
- if: inputs.release && (env.IS_TAG || github.ref_type == 'tag')

Copilot uses AI. Check for mistakes.
id: release
run: |
# shellcheck disable=SC2086,SC2206
ASSETS=(${INPUT_RELEASE_ASSETS:-})
if [ ${#ASSETS[@]} -eq 0 ]; then
if [ -d npm ]; then
(cd npm && npm pack 2>/dev/null)
ASSETS+=(./npm/*.tgz)
fi
fi
DRAFT=""
if [[ "${INPUT_RELEASE_DRAFT:-false}" == "true" ]]; then
DRAFT=true
fi
gh release create --title "${RELEASE_TITLE:-$GITHUB_REF_NAME}" --generate-notes --discussion-category "${INPUT_RELEASE_DISCUSSION_CATEGORY:-Releases}" "${DRAFT:+--draft}" "${RELEASE_TAG:-$GITHUB_REF_NAME}" "${ASSETS[@]}"
Comment on lines +189 to +204
Copy link

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The logic in the release step references environment variables using shell syntax (e.g., INPUT_RELEASE_ASSETS, INPUT_RELEASE_DRAFT, INPUT_RELEASE_DISCUSSION_CATEGORY), but these environment variables are not defined anywhere in the workflow. The workflow inputs are accessible via inputs.* in GitHub Actions expressions but are not automatically exposed as environment variables with INPUT_ prefix unless explicitly set.

To fix this, either:

  1. Add these to the env section of the job or step
  2. Use GitHub Actions expressions to pass the values directly to the script
  3. Use the correct input parameter names from the workflow

Copilot uses AI. Check for mistakes.
Comment on lines +189 to +204
Copy link

Copilot AI Jan 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The gh release create command is used without setting up authentication. The gh CLI tool requires either a GH_TOKEN or GITHUB_TOKEN environment variable to authenticate. While the job has contents: write permission, the GITHUB_TOKEN secret needs to be explicitly passed as an environment variable to this step.

Copilot uses AI. Check for mistakes.
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,4 @@ coverage
.cov
npm
!deno.lock
!coverage
Loading
Loading