@mannyc1/ts-release 0.2.2 → 0.3.0

package/templates/github-actions/reviewed-release.yml

@@ -14,32 +14,50 @@ permissions:
 jobs:
   prepare:
     if: ${{ github.ref == 'refs/heads/main' && github.sha == inputs.candidate_sha }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       prepared-ref: ${{ steps.prepare.outputs.prepared-ref }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22.22.2"
-      - uses: oven-sh/setup-bun@v2
+      - id: setup-bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: "1.3.14"
-      - run: bun add --global npm@11.5.1
+      - id: release-tools
+        name: Bind exact release tool paths
+        env:
+          SETUP_BUN_PATH: ${{ steps.setup-bun.outputs.bun-path }}
+        run: |-
+          node_path="$(type -P node)"
+          bun_path="$(type -P bun)"
+          [[ "$node_path" = /* && "$bun_path" = /* ]]
+          [[ "$("$node_path" --version)" == v22.22.2 ]]
+          [[ "$("$bun_path" --version)" == 1.3.14 ]]
+          [[ "$(realpath "$bun_path")" == "$(realpath "$SETUP_BUN_PATH")" ]]
+          echo "node-bin=$node_path" >> "$GITHUB_OUTPUT"
+          echo "bun-bin=$bun_path" >> "$GITHUB_OUTPUT"
+      - run: bun add --global npm@11.11.0
       - name: Prime isolated Bun dependency cache
         run: |-
           bun install --frozen-lockfile --ignore-scripts --no-save --linker=hoisted
           bun --no-env-file --no-install -e 'await (await import("node:fs/promises")).rm("node_modules", { recursive: true, force: true })'
       - id: prepare
-        uses: mannyc2/ts-release/apps/ts-release-action@v0.2.2
+        uses: mannyc2/ts-release/apps/ts-release-action@v0.3.0
+        env:
+          TS_RELEASE_NODE_BIN: ${{ steps.release-tools.outputs.node-bin }}
+          TS_RELEASE_BUN_BIN: ${{ steps.release-tools.outputs.bun-bin }}
         with:
           command: prepare
           config: reviewed-release.config.json
       - name: Upload redacted preparation report
         if: ${{ always() && steps.prepare.outputs.report-ref != '' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ts-release-prepare-report-${{ github.run_attempt }}
           path: ${{ steps.prepare.outputs.report-ref }}
@@ -48,32 +66,49 @@ jobs:
   publish:
     if: ${{ github.ref == 'refs/heads/main' && github.sha == inputs.candidate_sha }}
     needs: prepare
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     environment: release
     permissions:
       contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22.22.2"
-      - uses: oven-sh/setup-bun@v2
+      - id: setup-bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: "1.3.14"
-      - run: bun add --global npm@11.5.1
+      - id: release-tools
+        name: Bind exact release tool paths
+        env:
+          SETUP_BUN_PATH: ${{ steps.setup-bun.outputs.bun-path }}
+        run: |-
+          node_path="$(type -P node)"
+          bun_path="$(type -P bun)"
+          [[ "$node_path" = /* && "$bun_path" = /* ]]
+          [[ "$("$node_path" --version)" == v22.22.2 ]]
+          [[ "$("$bun_path" --version)" == 1.3.14 ]]
+          [[ "$(realpath "$bun_path")" == "$(realpath "$SETUP_BUN_PATH")" ]]
+          echo "node-bin=$node_path" >> "$GITHUB_OUTPUT"
+          echo "bun-bin=$bun_path" >> "$GITHUB_OUTPUT"
+      - run: bun add --global npm@11.11.0
       - id: publish
-        uses: mannyc2/ts-release/apps/ts-release-action@v0.2.2
+        uses: mannyc2/ts-release/apps/ts-release-action@v0.3.0
         env:
           GITHUB_TOKEN: ${{ github.token }}
+          TS_RELEASE_NODE_BIN: ${{ steps.release-tools.outputs.node-bin }}
+          TS_RELEASE_BUN_BIN: ${{ steps.release-tools.outputs.bun-bin }}
         with:
           command: publish
           prepared: ${{ needs.prepare.outputs.prepared-ref }}
       - name: Upload redacted publication report
         if: ${{ always() && steps.publish.outputs.report-ref != '' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ts-release-publish-report-${{ github.run_attempt }}
           path: ${{ steps.publish.outputs.report-ref }}