feat(monorepo-preview-release,preview-release): add publish_mode input

actions/monorepo-preview-release/action.yml

@@ -11,6 +11,10 @@ inputs:
     description: Token for authentication with npm registry
     required: false
 
+  publish_mode:
+    description: "Override publish mode detection: token-only | oidc-only | oidc-with-token-fallback"
+    required: false
+
   vland_bot_url:
     description: URL of the vland-bot server
     required: false

actions/monorepo-preview-release/src/core.ts

@@ -28,26 +28,37 @@ type Options = {
   prNumber: number;
   latestCommitSha: string;
   npmToken?: string;
+  publishMode?: PublishMode;
 };
 
-const PublishMode = {
+export const PublishMode = {
   OIDC_WITH_TOKEN_FALLBACK: "oidc-with-token-fallback",
   OIDC_ONLY: "oidc-only",
   TOKEN_ONLY: "token-only",
 } as const;
-type PublishMode = (typeof PublishMode)[keyof typeof PublishMode];
+export type PublishMode = (typeof PublishMode)[keyof typeof PublishMode];
+
+export function parsePublishMode(value: string): PublishMode | undefined {
+  if (!value) {
+    return undefined;
+  }
+
+  const modes = Object.values(PublishMode);
+
+  if (!modes.includes(value as PublishMode)) {
+    throw new Error(`Invalid publish_mode "${value}". Expected one of: ${modes.join(", ")}`);
+  }
+
+  return value as PublishMode;
+}
 
 async function bumpPackage(pkg: WorkspacePackage, preid: string): Promise<string> {
   // --no-git-checks: earlier bumps in the same run dirty the working tree,
   // and pnpm version refuses to run on an unclean tree by default
-  const result = await runLogged(
-    "pnpm",
-    ["version", "prerelease", "--preid", preid, "--no-git-tag-version", "--no-git-checks"],
-    {
-      cwd: pkg.path,
-      group: `pnpm version: ${pkg.name}`,
-    },
-  );
+  const result = await runLogged("pnpm", ["version", "prerelease", "--preid", preid, "--no-git-tag-version", "--no-git-checks"], {
+    cwd: pkg.path,
+    group: `pnpm version: ${pkg.name}`,
+  });
   if (result.exitCode !== 0) {
     throw new Error(`pnpm version failed for ${pkg.name} (exit ${result.exitCode}): ${result.output}`);
   }
@@ -133,7 +144,7 @@ export function getPublishTag(prNumber: number) {
 
 export async function publishPackages(options: Options): Promise<PublishResults> {
   const { octokit, workspaceDir = process.cwd(), owner, repo, prNumber, latestCommitSha, npmToken } = options;
-  const mode = detectMode(workspaceDir, !!npmToken);
+  const mode = options.publishMode ?? detectMode(workspaceDir, !!npmToken);
   core.debug(`mode: ${mode}, hasNpmToken: ${!!npmToken}`);
 
   return withNpmAuth(npmToken, async () => {

actions/monorepo-preview-release/src/index.ts

@@ -2,7 +2,7 @@ import * as core from "@actions/core";
 import * as github from "@actions/github";
 import { HttpClient } from "@actions/http-client";
 import { BearerCredentialHandler } from "@actions/http-client/lib/auth";
-import { publishPackages } from "./core.ts";
+import { parsePublishMode, publishPackages } from "./core.ts";
 
 try {
   // Refuse `pull_request_target`. The trigger gives the workflow access to
@@ -19,6 +19,7 @@ try {
   const githubToken = core.getInput("github_token", { required: true });
   const npmToken = core.getInput("npm_token") || undefined;
   const vlandBotUrl = core.getInput("vland_bot_url") || "https://bot.variable.land";
+  const publishMode = parsePublishMode(core.getInput("publish_mode"));
 
   if (npmToken) core.setSecret(npmToken);
 
@@ -46,6 +47,7 @@ try {
     prNumber,
     latestCommitSha,
     npmToken,
+    publishMode,
   });
 
   const oidcToken = await core.getIDToken("vland-bot");

actions/preview-release/action.yml

@@ -7,6 +7,10 @@ inputs:
     description: Token for authentication with npm registry
     required: false
 
+  publish_mode:
+    description: "Override publish mode detection: token-only | oidc-only | oidc-with-token-fallback"
+    required: false
+
   working_directory:
     description: Directory containing the package to publish
     required: false

actions/preview-release/src/core.ts

@@ -15,26 +15,37 @@ type Options = {
   prNumber: number;
   latestCommitSha: string;
   npmToken?: string;
+  publishMode?: PublishMode;
 };
 
-const PublishMode = {
+export const PublishMode = {
   OIDC_WITH_TOKEN_FALLBACK: "oidc-with-token-fallback",
   OIDC_ONLY: "oidc-only",
   TOKEN_ONLY: "token-only",
 } as const;
-type PublishMode = (typeof PublishMode)[keyof typeof PublishMode];
+export type PublishMode = (typeof PublishMode)[keyof typeof PublishMode];
+
+export function parsePublishMode(value: string): PublishMode | undefined {
+  if (!value) {
+    return undefined;
+  }
+
+  const modes = Object.values(PublishMode);
+
+  if (!modes.includes(value as PublishMode)) {
+    throw new Error(`Invalid publish_mode "${value}". Expected one of: ${modes.join(", ")}`);
+  }
+
+  return value as PublishMode;
+}
 
 async function bumpPackage(pkg: Package, preid: string): Promise<string> {
   // --no-git-checks: pnpm version refuses to run on an unclean working tree
   // by default, and CI steps before this one may leave the tree dirty
-  const result = await runLogged(
-    "pnpm",
-    ["version", "prerelease", "--preid", preid, "--no-git-tag-version", "--no-git-checks"],
-    {
-      cwd: pkg.path,
-      group: `pnpm version: ${pkg.name}`,
-    },
-  );
+  const result = await runLogged("pnpm", ["version", "prerelease", "--preid", preid, "--no-git-tag-version", "--no-git-checks"], {
+    cwd: pkg.path,
+    group: `pnpm version: ${pkg.name}`,
+  });
   if (result.exitCode !== 0) {
     throw new Error(`pnpm version failed for ${pkg.name} (exit ${result.exitCode}): ${result.output}`);
   }
@@ -120,7 +131,7 @@ export function getPublishTag(prNumber: number) {
 
 export async function release(options: Options): Promise<PublishResults> {
   const { workspaceDir = process.cwd(), prNumber, latestCommitSha, npmToken } = options;
-  const mode = detectMode(workspaceDir, !!npmToken);
+  const mode = options.publishMode ?? detectMode(workspaceDir, !!npmToken);
   core.debug(`mode: ${mode}, hasNpmToken: ${!!npmToken}`);
 
   return withNpmAuth(npmToken, async () => {

actions/preview-release/src/index.ts

@@ -3,7 +3,7 @@ import * as core from "@actions/core";
 import * as github from "@actions/github";
 import { HttpClient } from "@actions/http-client";
 import { BearerCredentialHandler } from "@actions/http-client/lib/auth";
-import { release } from "./core.ts";
+import { parsePublishMode, release } from "./core.ts";
 
 try {
   // Refuse `pull_request_target`. The trigger gives the workflow access to
@@ -20,6 +20,7 @@ try {
   const npmToken = core.getInput("npm_token") || undefined;
   const workingDirectory = core.getInput("working_directory") || ".";
   const vlandBotUrl = core.getInput("vland_bot_url") || "https://bot.variable.land";
+  const publishMode = parsePublishMode(core.getInput("publish_mode"));
 
   if (npmToken) core.setSecret(npmToken);
 
@@ -45,6 +46,7 @@ try {
     prNumber,
     latestCommitSha,
     npmToken,
+    publishMode,
   });
 
   const oidcToken = await core.getIDToken("vland-bot");