feat(ga4): extend protected resources to GA4 dimensions/metrics/key e… #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Changesets owns the version number. Merging to main opens (or updates) a "Release" pull | |
| # request carrying the bump and the changelog; merging that pull request is what publishes. | |
| on: | |
| push: | |
| branches: [main] | |
| jobs: | |
| # Which of the two halves should run. Without this gate the version job fails with | |
| # "No unreleased changesets found" on exactly the push that is supposed to publish, | |
| # and takes the publish job down with it. | |
| select-mode: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| mode: ${{ steps.select.outputs.mode }} | |
| steps: | |
| # Changesets compares against the base branch, so it needs the full history. | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| # select-mode shells out to @changesets/cli, so it has to be installed first. | |
| - run: npm ci | |
| - uses: changesets/action/select-mode@v2 | |
| id: select | |
| version: | |
| runs-on: ubuntu-latest | |
| needs: select-mode | |
| if: needs.select-mode.outputs.mode == 'version' | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| - run: npm ci | |
| - uses: changesets/action/version@v2 | |
| with: | |
| pr-title: 'Release' | |
| publish: | |
| runs-on: ubuntu-latest | |
| needs: select-mode | |
| if: needs.select-mode.outputs.mode == 'publish' | |
| permissions: | |
| # Lets the runner push the v* tag and create the GitHub release. | |
| contents: write | |
| # Lets the runner mint the OIDC token npm exchanges for publish rights, so no | |
| # npm token is stored in this repository. Also what gives the release its provenance. | |
| # | |
| # The trusted publisher on npm is bound to this workflow's path. Renaming this file | |
| # breaks every publish until the npm setting is updated to match. | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 24 | |
| registry-url: https://registry.npmjs.org | |
| cache: npm | |
| # Trusted publishing needs npm >= 11.5.1; Node 24 ships npm 11, this pins the floor. | |
| - run: npm install -g npm@latest | |
| - run: npm ci | |
| - run: npm run lint | |
| - run: npm run typecheck | |
| - run: npm test | |
| # prepack rebuilds dist/ from the clean checkout, and provenance is attached | |
| # automatically under OIDC. | |
| - uses: changesets/action/publish@v2 | |
| id: changesets | |
| with: | |
| script: npm run release | |
| create-github-releases: true | |
| - name: Notify companion action | |
| if: steps.changesets.outputs.published == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.ACTION_REPO_DISPATCH_TOKEN }} | |
| run: | | |
| version=$(node -p "require('./package.json').version") | |
| gh api repos/StackMade/gtm-as-code-action/dispatches \ | |
| -f event_type=cli-released \ | |
| -f "client_payload[version]=$version" |