Skip to content
Latchkey

Release to GitHub and npm workflow (timqian/chart.xkcd)

The Release to GitHub and npm workflow from timqian/chart.xkcd, explained and optimized by Latchkey.

F

CI health: F - at risk

Point runs-on at Latchkey and get caching, run de-duplication, job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →
Source: timqian/chart.xkcd.github/workflows/release.ymlLicense MITView source

What it does

This is the Release to GitHub and npm workflow from the timqian/chart.xkcd repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)
name: Release to GitHub and npm

on:
  push:
    branches: [master, main]
    paths:
      - 'package.json'
  workflow_dispatch:

jobs:
  release:
    runs-on: ubuntu-latest

    permissions:
      contents: write
      id-token: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
          registry-url: 'https://registry.npmjs.org'

      - name: Read version from package.json
        id: package
        run: |
          VERSION=$(node -p "require('./package.json').version")
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Version: $VERSION"

      - name: Check if release already exists
        id: check_release
        run: |
          if git rev-parse "v${{ steps.package.outputs.version }}" >/dev/null 2>&1; then
            echo "exists=true" >> $GITHUB_OUTPUT
          else
            echo "exists=false" >> $GITHUB_OUTPUT
          fi

      - name: Install dependencies
        if: steps.check_release.outputs.exists == 'false'
        run: npm install

      - name: Build
        if: steps.check_release.outputs.exists == 'false'
        run: npm run prepublishOnly

      - name: Publish to npm
        if: steps.check_release.outputs.exists == 'false'
        run: npm publish

      - name: Configure Git
        if: steps.check_release.outputs.exists == 'false'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Generate changelog
        if: steps.check_release.outputs.exists == 'false'
        id: changelog
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          REPO="${{ github.repository }}"
          if [ -z "$PREV_TAG" ]; then
            COMMITS=$(git log --pretty=format:"- [%s](https://github.com/${REPO}/commit/%H)" HEAD)
          else
            COMMITS=$(git log --pretty=format:"- [%s](https://github.com/${REPO}/commit/%H)" "${PREV_TAG}..HEAD")
          fi
          echo "commits<<EOF" >> $GITHUB_OUTPUT
          echo "$COMMITS" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Create Git Tag
        if: steps.check_release.outputs.exists == 'false'
        run: |
          git tag -a v${{ steps.package.outputs.version }} -m "Release v${{ steps.package.outputs.version }}"
          git push origin v${{ steps.package.outputs.version }}

      - name: Create GitHub Release
        if: steps.check_release.outputs.exists == 'false'
        uses: softprops/action-gh-release@v1
        with:
          tag_name: v${{ steps.package.outputs.version }}
          name: Release v${{ steps.package.outputs.version }}
          body: |
            ## What's Changed

            ${{ steps.changelog.outputs.commits }}
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The same workflow, on Latchkey

Estimated ~20% faster on cache hits, plus fewer wasted runs and a safer supply chain. Added and changed lines are highlighted.

name: Release to GitHub and npm
 
on:
  push:
    branches: [master, main]
    paths:
      - 'package.json'
  workflow_dispatch:
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  release:
    timeout-minutes: 30
    runs-on: latchkey-small
 
    permissions:
      contents: write
      id-token: write
 
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
 
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          cache: 'npm'
          node-version: 'lts/*'
          registry-url: 'https://registry.npmjs.org'
 
      - name: Read version from package.json
        id: package
        run: |
          VERSION=$(node -p "require('./package.json').version")
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Version: $VERSION"
 
      - name: Check if release already exists
        id: check_release
        run: |
          if git rev-parse "v${{ steps.package.outputs.version }}" >/dev/null 2>&1; then
            echo "exists=true" >> $GITHUB_OUTPUT
          else
            echo "exists=false" >> $GITHUB_OUTPUT
          fi
 
      - name: Install dependencies
        if: steps.check_release.outputs.exists == 'false'
        run: npm install
 
      - name: Build
        if: steps.check_release.outputs.exists == 'false'
        run: npm run prepublishOnly
 
      - name: Publish to npm
        if: steps.check_release.outputs.exists == 'false'
        run: npm publish
 
      - name: Configure Git
        if: steps.check_release.outputs.exists == 'false'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
 
      - name: Generate changelog
        if: steps.check_release.outputs.exists == 'false'
        id: changelog
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          REPO="${{ github.repository }}"
          if [ -z "$PREV_TAG" ]; then
            COMMITS=$(git log --pretty=format:"- [%s](https://github.com/${REPO}/commit/%H)" HEAD)
          else
            COMMITS=$(git log --pretty=format:"- [%s](https://github.com/${REPO}/commit/%H)" "${PREV_TAG}..HEAD")
          fi
          echo "commits<<EOF" >> $GITHUB_OUTPUT
          echo "$COMMITS" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT
 
      - name: Create Git Tag
        if: steps.check_release.outputs.exists == 'false'
        run: |
          git tag -a v${{ steps.package.outputs.version }} -m "Release v${{ steps.package.outputs.version }}"
          git push origin v${{ steps.package.outputs.version }}
 
      - name: Create GitHub Release
        if: steps.check_release.outputs.exists == 'false'
        uses: softprops/action-gh-release@v1
        with:
          tag_name: v${{ steps.package.outputs.version }}
          name: Release v${{ steps.package.outputs.version }}
          body: |
            ## What's Changed
 
            ${{ steps.changelog.outputs.commits }}
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

What changed

1 third-party action is referenced by a movable tag. Pin it to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

What Latchkey heals here

This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow