Enterprise-managed authorization console UI #3755
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish (pkg.pr.new) | |
| on: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: pkg-pr-new-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| # CI is not a user — see the note in ci.yml. Applied to every workflow rather | |
| # than the ones that look like they run product code: the first pass guessed, | |
| # missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert | |
| # where the product is not executed, so the blanket application is the cheap | |
| # structural answer. | |
| env: | |
| DO_NOT_TRACK: "1" | |
| EXECUTOR_DISABLE_ANALYTICS: "1" | |
| EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1" | |
| jobs: | |
| # Per-platform matrix: build the executor binary, tar it, upload to R2. | |
| # The wrapper npm package is built later by the `publish` job which just | |
| # needs to know which platforms made it this far. | |
| build-preview-binary: | |
| name: Build preview binary (${{ matrix.target }}) | |
| # Fork PRs don't receive repo secrets, so the R2 upload step can't | |
| # authenticate. Skip the whole preview pipeline (publish `needs:` this | |
| # job and cascades to skipped) rather than failing the check. | |
| if: github.event.pull_request.head.repo.full_name == github.repository | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: blacksmith-4vcpu-ubuntu-2404 | |
| target: executor-linux-x64 | |
| - runner: macos-14 | |
| target: executor-darwin-arm64 | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.11 | |
| - name: Cache Bun package cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: ${{ runner.os }}-bun-1.3.11-${{ hashFiles('bun.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-bun-1.3.11- | |
| # No prebuilt better-sqlite3 binary matches the Blacksmith Linux runner, | |
| # so `bun install` builds it from source via node-gyp, whose undici needs | |
| # Node 22.10+ (webidl.markAsUncloneable). | |
| - uses: actions/setup-node@v4 | |
| if: runner.os == 'Linux' | |
| with: | |
| node-version: 22 | |
| - run: bun install --frozen-lockfile | |
| - name: Build executor preview tarball | |
| env: | |
| EXECUTOR_PREVIEW_CDN_URL: ${{ vars.EXECUTOR_PREVIEW_CDN_URL }} | |
| EXECUTOR_PREVIEW_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| run: bun run --filter=executor build:preview:tarball | |
| - name: Upload preview binary to R2 | |
| # curl --aws-sigv4 handles large uploads directly against R2's S3 | |
| # endpoint. Simpler than aws-cli (endpoint validation quirks) or | |
| # Bun.s3 (ConnectionRefused on ubuntu-latest for reasons unclear). | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} | |
| R2_ENDPOINT: https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com | |
| SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| TARGET: ${{ matrix.target }} | |
| run: | | |
| tarball="apps/cli/dist/previews/${TARGET}.tar.gz" | |
| echo "Uploading ${TARGET}.tar.gz → r2://executor-previews/$SHA/" | |
| curl --fail-with-body --silent --show-error \ | |
| -X PUT "$R2_ENDPOINT/executor-previews/$SHA/${TARGET}.tar.gz" \ | |
| --upload-file "$tarball" \ | |
| --aws-sigv4 "aws:amz:auto:s3" \ | |
| --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" | |
| publish: | |
| name: Publish | |
| needs: build-preview-binary | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.11 | |
| - name: Cache Bun package cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: ${{ runner.os }}-bun-1.3.11-${{ hashFiles('bun.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-bun-1.3.11- | |
| # No prebuilt better-sqlite3 binary matches this runner, so `bun install` | |
| # builds it from source via node-gyp, whose undici needs Node 22.10+ | |
| # (webidl.markAsUncloneable). Pin the same runtime the CI jobs use. | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - run: bun install --frozen-lockfile | |
| - name: Build executor preview wrapper | |
| env: | |
| EXECUTOR_PREVIEW_CDN_URL: ${{ vars.EXECUTOR_PREVIEW_CDN_URL }} | |
| EXECUTOR_PREVIEW_SHA: ${{ github.event.pull_request.head.sha || github.sha }} | |
| EXECUTOR_PREVIEW_TARGETS: executor-linux-x64,executor-darwin-arm64 | |
| run: bun run --filter=executor build:preview:wrapper | |
| # Apply the same `publishConfig.exports` promotion and `workspace:*` | |
| # resolution the real npm release does. Runs `build:packages` | |
| # internally. Without this, pkg-pr-new ships unresolved | |
| # `workspace:*` references and the dev-time `src/index.ts` exports. | |
| - run: bun run release:publish:packages:prepare | |
| # Explicit list (not `plugins/*`) — must match PUBLIC_PACKAGE_DIRS | |
| # in scripts/publish-packages.ts. Globbing would pick up unprepared | |
| # private packages that would publish with broken refs. | |
| # | |
| # No --compact: it requires every package already exist on npm to | |
| # generate short URLs. New packages aren't published yet, and | |
| # --compact aborts the whole run when it can't resolve them. | |
| - run: > | |
| npx pkg-pr-new publish --bun | |
| './apps/cli/dist/executor' | |
| './packages/core/storage-core' | |
| './packages/core/sdk' | |
| './packages/core/config' | |
| './packages/core/execution' | |
| './packages/core/cli' | |
| './packages/kernel/core' | |
| './packages/kernel/runtime-quickjs' | |
| './packages/plugins/file-secrets' | |
| './packages/plugins/graphql' | |
| './packages/plugins/keychain' | |
| './packages/plugins/mcp' | |
| './packages/plugins/onepassword' | |
| './packages/plugins/openapi' |