npm-publish-dev.yml

name: npm Publish dev

on:
    push:
        branches: [main]

jobs:
    publish:
        runs-on: ubuntu-latest
        permissions:
            id-token: write
        steps:
            - uses: actions/checkout@v4
            - name: Use Node.js 20
              uses: actions/setup-node@v4
              with:
                  node-version: 20.11.1
                  # More info: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages#publishing-packages-to-the-npm-registry
                  registry-url: 'https://registry.npmjs.org'
            - name: Use node_modules cache
              uses: actions/cache@v4
              with:
                  path: node_modules
                  key: yarn-node-20-lock-${{ hashFiles('yarn.lock') }}
                  restore-keys: |
                      yarn-node-20-lock-
            - run: yarn install --frozen-lockfile
            - run: yarn build
            - uses: actions/upload-artifact@v4
              with:
                  name: build-output
                  path: dist
                  if-no-files-found: error
            - uses: martinbeentjes/npm-get-version-action@v1.3.1
              id: package-version
            - run: yarn version --no-git-tag-version --new-version ${{ steps.package-version.outputs.current-version }}-dev.${{ github.sha }}
              # npm install -g npm@latest is necessary to make provenance available (available since v9.6.5 or so). More info: https://docs.npmjs.com/generating-provenance-statements
            - run: npm install -g npm@latest
            - run: npm publish --access public --tag dev
              env:
                  # Is connected with actions/setup-node -> registry-url
                  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}