action.yml

name: 'Publish preview packages to the registry bridge'
description: >-
  Pack locally built package directories and publish them, plus their
  integrity, to the pkg-pr-registry-bridge as the synthetic commit version.
  Packs with `pnpm pack` (resolving workspace:/catalog: specs), so run
  pnpm/action-setup and `pnpm install` first. Runs the CPU-heavy work in CI so
  the Worker only serves. No pkg.pr.new involvement.
inputs:
  mode:
    description: >-
      publish (default): pack and upload in one job, authenticated by
      admin-token. pack: write raw `pnpm pack` output to output-dir and stop, so
      it holds no credentials and can run in a job that builds an untrusted fork
      PR. upload: read input-dir, validate and rebuild every archive, then
      publish; run this in a trusted workflow_run job. See RFC 0002.
    required: false
    default: 'publish'
  sha:
    description: >-
      The commit sha to publish (a 7-40 hex sha, or commit.<sha>). In upload
      mode wire this to github.event.workflow_run.head_sha: it is the trusted
      source of the published version, which is what lets the artifact's own
      manifest stay advisory.
    required: true
  output-dir:
    description: 'pack mode: directory to write the packed tarballs into.'
    required: false
    default: 'bridge-packages'
  input-dir:
    description: 'upload mode: directory holding the tarballs from a pack run.'
    required: false
    default: 'bridge-packages'
  packages:
    description: >-
      Package directories to publish, newline- or comma-separated, relative to
      the workspace. A trailing "/*" expands to every direct subdirectory
      containing a package.json (e.g. packages/cli/npm/*). Pass the same
      directories a registry publish would cover; deps between them are pinned
      to the synthetic version. Defaults to the vite-plus layout (packages/cli,
      packages/core, packages/prompts, packages/cli/npm/*,
      packages/cli/cli-npm/*); the authoritative default lives in the action.
    required: false
  bridge-url:
    description: 'Base URL of the registry bridge.'
    required: false
    default: 'https://registry-bridge.viteplus.dev'
  admin-token:
    description: >-
      Bridge ADMIN_TOKEN (store as a secret). Optional: when omitted, the action
      mints a GitHub Actions OIDC token instead, which needs
      `permissions: id-token: write` on the job and the bridge configured with
      OIDC_AUDIENCE / OIDC_TRUSTED_WORKFLOWS / OIDC_TRUSTED_REPOSITORY_ID /
      OIDC_TRUSTED_OWNER_ID. Fork pull_request runs are never granted id-token,
      which is why upload mode belongs in a workflow_run job.
    required: false
  pr-url:
    description: >-
      URL of the source pull request, surfaced by /-/refs. Optional: pass
      github.event.pull_request.html_url on pull_request runs; leave empty on
      push/commit runs. In upload mode derive it from the GitHub API using the
      triggering run's head_sha, NOT from the artifact: the bridge maps it to
      the pr-<n> dist-tag, so an attacker-supplied value would change what
      VP_PR_VERSION installs for a different PR.
    required: false
  workspace-packages:
    description: 'Allowlist (comma-separated exact names or prefix* patterns).'
    required: false
    default: 'vite-plus,@voidzero-dev/vite-plus-*'
outputs:
  version:
    description: 'The synthetic version published (0.0.0-commit.<sha>).'
runs:
  using: 'node24'
  # Bundle lives under .github/actions/ (built by `pnpm build:action`); this
  # action.yml is at the repo root so it can be used as `<owner>/<repo>@<ref>`.
  main: '.github/actions/publish-preview/dist/index.mjs'