Release to GitHub and npm workflow (timqian/chart.xkcd)
The Release to GitHub and npm workflow from timqian/chart.xkcd, explained and optimized by Latchkey.
CI health: F - at risk
Point runs-on at Latchkey and get caching, run de-duplication, job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.
What it does
This is the Release to GitHub and npm workflow from the timqian/chart.xkcd repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.
Below, Latchkey shows a faster, safer version produced by its optimization engine.
The workflow
name: Release to GitHub and npm
on:
push:
branches: [master, main]
paths:
- 'package.json'
workflow_dispatch:
jobs:
release:
runs-on: ubuntu-latest
permissions:
contents: write
id-token: write
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: 'lts/*'
registry-url: 'https://registry.npmjs.org'
- name: Read version from package.json
id: package
run: |
VERSION=$(node -p "require('./package.json').version")
echo "version=$VERSION" >> $GITHUB_OUTPUT
echo "Version: $VERSION"
- name: Check if release already exists
id: check_release
run: |
if git rev-parse "v${{ steps.package.outputs.version }}" >/dev/null 2>&1; then
echo "exists=true" >> $GITHUB_OUTPUT
else
echo "exists=false" >> $GITHUB_OUTPUT
fi
- name: Install dependencies
if: steps.check_release.outputs.exists == 'false'
run: npm install
- name: Build
if: steps.check_release.outputs.exists == 'false'
run: npm run prepublishOnly
- name: Publish to npm
if: steps.check_release.outputs.exists == 'false'
run: npm publish
- name: Configure Git
if: steps.check_release.outputs.exists == 'false'
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
- name: Generate changelog
if: steps.check_release.outputs.exists == 'false'
id: changelog
run: |
PREV_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
REPO="${{ github.repository }}"
if [ -z "$PREV_TAG" ]; then
COMMITS=$(git log --pretty=format:"- [%s](https://github.com/${REPO}/commit/%H)" HEAD)
else
COMMITS=$(git log --pretty=format:"- [%s](https://github.com/${REPO}/commit/%H)" "${PREV_TAG}..HEAD")
fi
echo "commits<<EOF" >> $GITHUB_OUTPUT
echo "$COMMITS" >> $GITHUB_OUTPUT
echo "EOF" >> $GITHUB_OUTPUT
- name: Create Git Tag
if: steps.check_release.outputs.exists == 'false'
run: |
git tag -a v${{ steps.package.outputs.version }} -m "Release v${{ steps.package.outputs.version }}"
git push origin v${{ steps.package.outputs.version }}
- name: Create GitHub Release
if: steps.check_release.outputs.exists == 'false'
uses: softprops/action-gh-release@v1
with:
tag_name: v${{ steps.package.outputs.version }}
name: Release v${{ steps.package.outputs.version }}
body: |
## What's Changed
${{ steps.changelog.outputs.commits }}
draft: false
prerelease: false
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}The same workflow, on Latchkey
Estimated ~20% faster on cache hits, plus fewer wasted runs and a safer supply chain. Added and changed lines are highlighted.
name: Release to GitHub and npm on: push: branches: [master, main] paths: - 'package.json' workflow_dispatch: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true jobs: release: timeout-minutes: 30 runs-on: latchkey-small permissions: contents: write id-token: write steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up Node.js uses: actions/setup-node@v4 with: cache: 'npm' node-version: 'lts/*' registry-url: 'https://registry.npmjs.org' - name: Read version from package.json id: package run: | VERSION=$(node -p "require('./package.json').version") echo "version=$VERSION" >> $GITHUB_OUTPUT echo "Version: $VERSION" - name: Check if release already exists id: check_release run: | if git rev-parse "v${{ steps.package.outputs.version }}" >/dev/null 2>&1; then echo "exists=true" >> $GITHUB_OUTPUT else echo "exists=false" >> $GITHUB_OUTPUT fi - name: Install dependencies if: steps.check_release.outputs.exists == 'false' run: npm install - name: Build if: steps.check_release.outputs.exists == 'false' run: npm run prepublishOnly - name: Publish to npm if: steps.check_release.outputs.exists == 'false' run: npm publish - name: Configure Git if: steps.check_release.outputs.exists == 'false' run: | git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" - name: Generate changelog if: steps.check_release.outputs.exists == 'false' id: changelog run: | PREV_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "") REPO="${{ github.repository }}" if [ -z "$PREV_TAG" ]; then COMMITS=$(git log --pretty=format:"- [%s](https://github.com/${REPO}/commit/%H)" HEAD) else COMMITS=$(git log --pretty=format:"- [%s](https://github.com/${REPO}/commit/%H)" "${PREV_TAG}..HEAD") fi echo "commits<<EOF" >> $GITHUB_OUTPUT echo "$COMMITS" >> $GITHUB_OUTPUT echo "EOF" >> $GITHUB_OUTPUT - name: Create Git Tag if: steps.check_release.outputs.exists == 'false' run: | git tag -a v${{ steps.package.outputs.version }} -m "Release v${{ steps.package.outputs.version }}" git push origin v${{ steps.package.outputs.version }} - name: Create GitHub Release if: steps.check_release.outputs.exists == 'false' uses: softprops/action-gh-release@v1 with: tag_name: v${{ steps.package.outputs.version }} name: Release v${{ steps.package.outputs.version }} body: | ## What's Changed ${{ steps.changelog.outputs.commits }} draft: false prerelease: false env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
What changed
- Run on Latchkey managed runners with one line (
runs-on), which apply the fixes below automatically and self-heal transient failures. This example useslatchkey-small; pick the runner size that fits the job. - Cancel superseded runs when a branch or PR gets a newer push.
- Cache dependency installs on the setup step so they are served from cache.
- Add a job timeout so a hung step cannot burn hours of runner time.
1 third-party action is referenced by a movable tag. Pin it to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.
What Latchkey heals here
This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:
- Dependency installs
This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.