fix(memory): use Eval experiment pairing subpath (#121) #64
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| jobs: | |
| verify: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| registry-url: https://registry.npmjs.org | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: '3.12' | |
| - name: Install deps | |
| run: pnpm install --frozen-lockfile | |
| - name: Lint | |
| run: pnpm run lint | |
| - name: Typecheck | |
| run: pnpm run typecheck | |
| - name: Test | |
| run: pnpm run test | |
| - name: Build | |
| run: pnpm run build | |
| - name: Verify packed package lifecycle | |
| run: pnpm run verify:package | |
| - name: Run packed package through official GEPA and SkillOpt | |
| run: pnpm run verify:official-optimizers | |
| - name: Verify tag/version lock | |
| run: | | |
| NPM_VERSION=$(node -p "require('./package.json').version") | |
| if [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then | |
| TAG_VERSION="${GITHUB_REF#refs/tags/v}" | |
| if [ "$TAG_VERSION" != "$NPM_VERSION" ]; then | |
| echo "::error::Tag/version mismatch: tag=$TAG_VERSION package=$NPM_VERSION." | |
| exit 1 | |
| fi | |
| fi | |
| echo "Version locked: $NPM_VERSION" | |
| publish-npm: | |
| needs: verify | |
| if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm run build | |
| # Tokenless OIDC trusted publishing uses a short-lived credential. The | |
| # exchange is an npm CLI feature (>= 11.5.1; Node 22 | |
| # bundles npm 10) and pnpm only signs provenance (the PUT then 404s on | |
| # auth), so upgrade npm and publish with it. This package has no | |
| # `workspace:` deps, so npm publish is safe. No setup-node registry-url: | |
| # it writes an empty-authToken .npmrc that blocks OIDC. Idempotent. | |
| # Requires the npmjs Trusted Publisher: org tangle-network, repo | |
| # agent-knowledge, workflow publish.yml. | |
| - name: Publish to npm (OIDC trusted publishing) | |
| run: | | |
| # npm 12.0.0 omits a provenance dependency required by libnpmpublish. | |
| # npm 11 supports OIDC and is the current known-good release line. | |
| npm install -g npm@11 | |
| NAME=$(node -p "require('./package.json').name") | |
| VERSION=$(node -p "require('./package.json').version") | |
| if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then | |
| echo "$NAME@$VERSION already on registry; skipping publish" | |
| else | |
| npm publish --provenance --access public | |
| fi |