pnpm-publish.yml

name: Pipeline - PNPM Publish

on:
  workflow_call:
    secrets:
      npm_token:
        description: 'The NPM Registry Token to use'
        required: true

jobs:
  pnpm-publish:
    runs-on: ubuntu-latest
    steps:

       # More info: https://github.com/step-security/harden-runner.
      - name: Harden Runner
        id: harden_runner
        uses: step-security/harden-runner@c8454efe5d0bdefd25384362fe217428ca277d57
        with:
          egress-policy: audit

      # More info: https://github.com/peter-murray/workflow-application-token-action.
      - name: Get token
        id: get_token
        uses: peter-murray/workflow-application-token-action@8e1ba3bf1619726336414f1014e37f17fbadf1db
        with:
          application_id: ${{ secrets.ID_PRLINTERBOT }}
          application_private_key: ${{ secrets.PEM_PRLINTERBOT }}

      # More info: https://github.com/actions/checkout.
      - name: Checkout & Authentication
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
        with:
          token: ${{ steps.get_token.outputs.token }}
          persist-credentials: false
          fetch-depth: 0

      - uses: pnpm/action-setup@

      - name: NPM Publish
        uses: actions/setup-node@
        with:
          node-version: '16.x'
          registry-url: 'https://registry.npmjs.org'
          cache: 'pnpm'
      
      - run: pnpm install

      # pnpm fails on publish if we don't include --no-git-checks
      - run: pnpm -r publish --no-git-checks --access=public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.npm_token }}