fix(ci): batch 31 (4 files)

2026-05-30 19:12:05 +09:00
parent de174b06e6
commit ae6ef6023c
4 changed files with 359 additions and 131 deletions
@@ -49,7 +49,7 @@ jobs:

      - uses: oven-sh/setup-bun@v2
        with:
-          bun-version: latest
+          bun-version: "1.3.12"

      - name: Install dependencies
        run: bun install --frozen-lockfile
@@ -75,8 +75,8 @@ jobs:
            exit 1
          fi

-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "dist_tag=$DIST_TAG" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "dist_tag=$DIST_TAG" >> "$GITHUB_OUTPUT"

      - name: Check if already published
        id: check
@@ -95,26 +95,26 @@ jobs:
          echo "oh-my-openagent-${{ matrix.platform }}@${VERSION}: ${OA_STATUS}"
          
          if [ "$OC_STATUS" = "200" ]; then
-            echo "skip_opencode=true" >> $GITHUB_OUTPUT
+            echo "skip_opencode=true" >> "$GITHUB_OUTPUT"
            echo "✓ oh-my-opencode-${{ matrix.platform }}@${VERSION} already published"
          else
-            echo "skip_opencode=false" >> $GITHUB_OUTPUT
+            echo "skip_opencode=false" >> "$GITHUB_OUTPUT"
            echo "→ oh-my-opencode-${{ matrix.platform }}@${VERSION} needs publishing"
          fi
          
          if [ "$OA_STATUS" = "200" ]; then
-            echo "skip_openagent=true" >> $GITHUB_OUTPUT
+            echo "skip_openagent=true" >> "$GITHUB_OUTPUT"
            echo "✓ oh-my-openagent-${{ matrix.platform }}@${VERSION} already published"
          else
-            echo "skip_openagent=false" >> $GITHUB_OUTPUT
+            echo "skip_openagent=false" >> "$GITHUB_OUTPUT"
            echo "→ oh-my-openagent-${{ matrix.platform }}@${VERSION} needs publishing"
          fi
          
          # Skip build only if BOTH are already published
          if [ "$OC_STATUS" = "200" ] && [ "$OA_STATUS" = "200" ]; then
-            echo "skip=true" >> $GITHUB_OUTPUT
+            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
-            echo "skip=false" >> $GITHUB_OUTPUT
+            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Update version in package.json
@@ -288,8 +288,8 @@ jobs:
            exit 1
          fi

-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "dist_tag=$DIST_TAG" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "dist_tag=$DIST_TAG" >> "$GITHUB_OUTPUT"

      - name: Check if already published
        id: check
@@ -300,30 +300,29 @@ jobs:
          OA_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/oh-my-openagent-${{ matrix.platform }}/${VERSION}")
          
          if [ "$OC_STATUS" = "200" ]; then
-            echo "skip_opencode=true" >> $GITHUB_OUTPUT
+            echo "skip_opencode=true" >> "$GITHUB_OUTPUT"
            echo "✓ oh-my-opencode-${{ matrix.platform }}@${VERSION} already published"
          else
-            echo "skip_opencode=false" >> $GITHUB_OUTPUT
+            echo "skip_opencode=false" >> "$GITHUB_OUTPUT"
          fi
          
          if [ "$OA_STATUS" = "200" ]; then
-            echo "skip_openagent=true" >> $GITHUB_OUTPUT
+            echo "skip_openagent=true" >> "$GITHUB_OUTPUT"
            echo "✓ oh-my-openagent-${{ matrix.platform }}@${VERSION} already published"
          else
-            echo "skip_openagent=false" >> $GITHUB_OUTPUT
+            echo "skip_openagent=false" >> "$GITHUB_OUTPUT"
          fi
          
          # Need artifact if either package needs publishing
          if [ "$OC_STATUS" = "200" ] && [ "$OA_STATUS" = "200" ]; then
-            echo "skip_all=true" >> $GITHUB_OUTPUT
+            echo "skip_all=true" >> "$GITHUB_OUTPUT"
          else
-            echo "skip_all=false" >> $GITHUB_OUTPUT
+            echo "skip_all=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Download artifact
        id: download
        if: steps.check.outputs.skip_all != 'true'
-        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          name: binary-${{ matrix.platform }}
@@ -22,6 +22,11 @@ on:
        required: false
        type: boolean
        default: false
+      publish_lazycodex:
+        description: "Publish lazycodex npm alias and sync Codex marketplace"
+        required: false
+        type: boolean
+        default: false

 concurrency: ${{ github.workflow }}-${{ github.ref }}

@@ -38,7 +43,7 @@ jobs:

      - uses: oven-sh/setup-bun@v2
        with:
-          bun-version: "1.3.11"
+          bun-version: "1.3.12"

      - name: Install dependencies
        run: bun install --frozen-lockfile
@@ -55,7 +60,7 @@ jobs:

      - uses: oven-sh/setup-bun@v2
        with:
-          bun-version: "1.3.11"
+          bun-version: "1.3.12"

      - name: Install dependencies
        run: bun install --frozen-lockfile
@@ -72,10 +77,21 @@ jobs:
      id-token: write
      contents: read
    steps:
-      - name: Verify trusted publisher for all 24 packages
+      - name: Require LazyCodex sync token
+        if: inputs.publish_lazycodex == true
+        env:
+          LAZYCODEX_SYNC_TOKEN: ${{ secrets.LAZYCODEX_SYNC_TOKEN }}
+        run: |
+          if [ -z "$LAZYCODEX_SYNC_TOKEN" ]; then
+            echo "::error::LAZYCODEX_SYNC_TOKEN is required to push the Codex marketplace bundle to code-yeongyu/lazycodex."
+            exit 1
+          fi
+
+      - name: Verify trusted publisher for release packages
        env:
          REPO: code-yeongyu/oh-my-openagent
          WORKFLOW_FILE: publish.yml
+          PUBLISH_LAZYCODEX: ${{ inputs.publish_lazycodex }}
        run: |
          OIDC_TOKEN=$(curl -sH "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=npm:registry.npmjs.org" \
@@ -88,6 +104,9 @@ jobs:

          PLATFORMS=(darwin-arm64 darwin-x64 darwin-x64-baseline linux-x64 linux-x64-baseline linux-arm64 linux-x64-musl linux-x64-musl-baseline linux-arm64-musl windows-x64 windows-x64-baseline)
          ALL_PACKAGES=(oh-my-opencode oh-my-openagent)
+          if [ "${PUBLISH_LAZYCODEX}" = "true" ]; then
+            ALL_PACKAGES+=(lazycodex)
+          fi
          for plat in "${PLATFORMS[@]}"; do
            ALL_PACKAGES+=("oh-my-opencode-${plat}")
            ALL_PACKAGES+=("oh-my-openagent-${plat}")
@@ -113,57 +132,56 @@ jobs:
          done

          if [ ${#FAILED[@]} -gt 0 ]; then
-            {
-              echo
-              echo "::error::Trusted publisher not configured for ${#FAILED[@]} package(s)."
-              echo "::error::Configure each below at the URL with these values:"
-              echo "::error::  Provider: GitHub Actions"
-              echo "::error::  Organization: code-yeongyu"
-              echo "::error::  Repository: ${REPO}"
-              echo "::error::  Workflow filename: ${WORKFLOW_FILE}"
-              echo
-              for pkg in "${FAILED[@]}"; do
-                echo "::error::  https://www.npmjs.com/package/${pkg}/access"
-              done
-            } >&2
-            exit 1
+            HARD_FAILED=()
+            SOFT_FAILED=()
+            for pkg in "${FAILED[@]}"; do
+              if [ "${pkg}" = "lazycodex" ]; then
+                SOFT_FAILED+=("${pkg}")
+              else
+                HARD_FAILED+=("${pkg}")
+              fi
+            done
+
+            if [ ${#HARD_FAILED[@]} -gt 0 ]; then
+              {
+                echo
+                echo "::error::Trusted publisher not configured for ${#HARD_FAILED[@]} required package(s)."
+                echo "::error::Configure each below at the URL with these values:"
+                echo "::error::  Provider: GitHub Actions"
+                echo "::error::  Organization: code-yeongyu"
+                echo "::error::  Repository: ${REPO}"
+                echo "::error::  Workflow filename: ${WORKFLOW_FILE}"
+                echo
+                for pkg in "${HARD_FAILED[@]}"; do
+                  echo "::error::  https://www.npmjs.com/package/${pkg}/access"
+                done
+              } >&2
+              exit 1
+            fi
+
+            if [ ${#SOFT_FAILED[@]} -gt 0 ]; then
+              {
+                echo
+                echo "::warning::Trusted publisher is not configured for lazycodex yet."
+                echo "::warning::First publish can require a one-time manual npm publish to claim the name."
+                echo "::warning::After claiming, configure GitHub Actions trusted publishing at:"
+                echo "::warning::  https://www.npmjs.com/package/lazycodex/access"
+                echo "::warning::  Organization: code-yeongyu"
+                echo "::warning::  Repository: ${REPO}"
+                echo "::warning::  Workflow filename: ${WORKFLOW_FILE}"
+              }
+            fi
          fi

          echo
          echo "All ${#ALL_PACKAGES[@]} packages have trusted publisher configured."

-  publish-main:
+  release-metadata:
    runs-on: ubuntu-latest
-    needs: [test, typecheck, preflight-trust]
-    if: github.repository == 'code-yeongyu/oh-my-openagent'
    outputs:
      version: ${{ steps.version.outputs.version }}
      dist_tag: ${{ steps.version.outputs.dist_tag }}
    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          submodules: recursive
-
-      - run: git fetch --force --tags
-
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3.11"
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "24"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Upgrade npm for trusted publishing (>=11.5.1)
-        run: npm install -g npm@latest
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-        env:
-          BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/cli @ast-grep/napi"
-
      - name: Calculate version
        id: version
        env:
@@ -187,7 +205,7 @@ jobs:
            exit 1
          fi

-          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

          if [[ "$VERSION" == *"-"* ]]; then
            DIST_TAG=$(printf '%s' "$VERSION" | cut -d'-' -f2 | cut -d'.' -f1)
@@ -195,30 +213,123 @@ jobs:
              echo "::error::Invalid dist_tag: $DIST_TAG"
              exit 1
            fi
-            echo "dist_tag=${DIST_TAG:-next}" >> $GITHUB_OUTPUT
+            echo "dist_tag=${DIST_TAG:-next}" >> "$GITHUB_OUTPUT"
          else
-            echo "dist_tag=" >> $GITHUB_OUTPUT
+            echo "dist_tag=" >> "$GITHUB_OUTPUT"
          fi

          echo "Version: $VERSION"

+  publish-main:
+    runs-on: ubuntu-latest
+    needs: [test, typecheck, preflight-trust, release-metadata, publish-platform]
+    if: >-
+      always() &&
+      github.repository == 'code-yeongyu/oh-my-openagent' &&
+      needs.test.result == 'success' &&
+      needs.typecheck.result == 'success' &&
+      needs.preflight-trust.result == 'success' &&
+      needs.release-metadata.result == 'success' &&
+      (inputs.skip_platform == true || needs.publish-platform.result == 'success')
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - run: git fetch --force --tags
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.12"
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Upgrade npm for trusted publishing (>=11.5.1)
+        run: npm install -g npm@latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+        env:
+          BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/cli @ast-grep/napi"
+
+      - name: Verify platform packages are published
+        env:
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+        run: |
+          PLATFORMS=(darwin-arm64 darwin-x64 darwin-x64-baseline linux-x64 linux-x64-baseline linux-arm64 linux-x64-musl linux-x64-musl-baseline linux-arm64-musl windows-x64 windows-x64-baseline)
+          FAILED=()
+          for platform in "${PLATFORMS[@]}"; do
+            for family in oh-my-opencode oh-my-openagent; do
+              pkg="${family}-${platform}"
+              STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/${pkg}/${VERSION}")
+              if [ "$STATUS" = "200" ]; then
+                echo "OK   ${pkg}@${VERSION}"
+              else
+                echo "MISS ${pkg}@${VERSION} (HTTP ${STATUS})"
+                FAILED+=("${pkg}")
+              fi
+            done
+          done
+
+          if [ ${#FAILED[@]} -gt 0 ]; then
+            echo "::error::Missing platform package(s); refusing to publish wrappers."
+            for pkg in "${FAILED[@]}"; do
+              echo "::error::  ${pkg}@${VERSION}"
+            done
+            exit 1
+          fi
+
      - name: Check if already published
        id: check
        env:
-          VERSION: ${{ steps.version.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
        run: |
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/oh-my-opencode/${VERSION}")
          if [ "$STATUS" = "200" ]; then
-            echo "skip=true" >> $GITHUB_OUTPUT
+            echo "skip=true" >> "$GITHUB_OUTPUT"
            echo "✓ oh-my-opencode@${VERSION} already published"
          else
-            echo "skip=false" >> $GITHUB_OUTPUT
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Check if oh-my-openagent already published
+        id: check-openagent
+        env:
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+        run: |
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/oh-my-openagent/${VERSION}")
+          if [ "$STATUS" = "200" ]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "✓ oh-my-openagent@${VERSION} already published"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Check if lazycodex already published
+        if: inputs.publish_lazycodex == true
+        id: check-lazycodex
+        env:
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+        run: |
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/lazycodex/${VERSION}")
+          if [ "$STATUS" = "200" ]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "✓ lazycodex@${VERSION} already published"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Update version
-        if: steps.check.outputs.skip != 'true'
+        if: >-
+          steps.check.outputs.skip != 'true' ||
+          steps.check-openagent.outputs.skip != 'true' ||
+          (inputs.publish_lazycodex == true && steps.check-lazycodex.outputs.skip != 'true')
        env:
-          VERSION: ${{ steps.version.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
        run: |
          jq --arg v "$VERSION" '.version = $v' package.json > tmp.json && mv tmp.json package.json

@@ -229,13 +340,21 @@ jobs:
          done

          jq --arg v "$VERSION" '.optionalDependencies = (.optionalDependencies | to_entries | map(.value = $v) | from_entries)' package.json > tmp.json && mv tmp.json package.json
+          jq --arg v "$VERSION" '.version = $v' packages/omo-codex/plugin/.codex-plugin/plugin.json > tmp.json && mv tmp.json packages/omo-codex/plugin/.codex-plugin/plugin.json
+          jq --arg v "$VERSION" '.version = $v' packages/omo-codex/plugin/package.json > tmp.json && mv tmp.json packages/omo-codex/plugin/package.json

      - name: Build main package
-        if: steps.check.outputs.skip != 'true'
+        if: >-
+          steps.check.outputs.skip != 'true' ||
+          steps.check-openagent.outputs.skip != 'true' ||
+          (inputs.publish_lazycodex == true && steps.check-lazycodex.outputs.skip != 'true')
        run: bun run build

      - name: Strip token auth from .npmrc to force OIDC
-        if: steps.check.outputs.skip != 'true'
+        if: >-
+          steps.check.outputs.skip != 'true' ||
+          steps.check-openagent.outputs.skip != 'true' ||
+          (inputs.publish_lazycodex == true && steps.check-lazycodex.outputs.skip != 'true')
        run: |
          for f in .npmrc "$HOME/.npmrc"; do
            if [ -f "$f" ]; then
@@ -248,7 +367,7 @@ jobs:
      - name: Publish oh-my-opencode
        if: steps.check.outputs.skip != 'true'
        env:
-          DIST_TAG: ${{ steps.version.outputs.dist_tag }}
+          DIST_TAG: ${{ needs.release-metadata.outputs.dist_tag }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          if [ -n "$DIST_TAG" ]; then
@@ -257,24 +376,11 @@ jobs:
            npm publish --access public --provenance --loglevel verbose
          fi

-      - name: Check if oh-my-openagent already published
-        id: check-openagent
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/oh-my-openagent/${VERSION}")
-          if [ "$STATUS" = "200" ]; then
-            echo "skip=true" >> $GITHUB_OUTPUT
-            echo "✓ oh-my-openagent@${VERSION} already published"
-          else
-            echo "skip=false" >> $GITHUB_OUTPUT
-          fi
-
      - name: Publish oh-my-openagent
        if: steps.check-openagent.outputs.skip != 'true'
        env:
-          VERSION: ${{ steps.version.outputs.version }}
-          DIST_TAG: ${{ steps.version.outputs.dist_tag }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+          DIST_TAG: ${{ needs.release-metadata.outputs.dist_tag }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          # Update package name, version, and optionalDependencies for oh-my-openagent
@@ -299,19 +405,64 @@ jobs:
        run: |
          git checkout -- package.json

+      - name: Publish lazycodex
+        if: inputs.publish_lazycodex == true && steps.check-lazycodex.outputs.skip != 'true'
+        continue-on-error: true
+        env:
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+          DIST_TAG: ${{ needs.release-metadata.outputs.dist_tag }}
+          NPM_CONFIG_PROVENANCE: true
+        run: |
+          jq --arg v "$VERSION" '
+            .name = "lazycodex" |
+            .version = $v |
+            .optionalDependencies = (.optionalDependencies | to_entries | map(.value = $v) | from_entries)
+          ' package.json > tmp.json && mv tmp.json package.json
+
+          set +e
+          if [ -n "$DIST_TAG" ]; then
+            npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose
+          else
+            npm publish --access public --provenance --loglevel verbose
+          fi
+          PUBLISH_STATUS=$?
+          set -e
+
+          if [ "$PUBLISH_STATUS" -ne 0 ]; then
+            echo "::warning::lazycodex publish failed. If this is the first publish, claim it once manually from a trusted environment (with NPM_AUTH_TOKEN) using npm publish."
+            echo "::warning::Then configure GitHub Actions trusted publishing at https://www.npmjs.com/package/lazycodex/access with org=code-yeongyu repo=oh-my-openagent workflow=publish.yml."
+            exit 0
+          fi
+
+      - name: Restore package.json after lazycodex publish attempt
+        if: always() && inputs.publish_lazycodex == true && steps.check-lazycodex.outputs.skip != 'true'
+        run: |
+          git checkout -- package.json
+
  publish-platform:
-    needs: publish-main
-    if: inputs.skip_platform != true
+    needs: [test, typecheck, preflight-trust, release-metadata]
+    if: >-
+      always() &&
+      github.repository == 'code-yeongyu/oh-my-openagent' &&
+      inputs.skip_platform != true &&
+      needs.test.result == 'success' &&
+      needs.typecheck.result == 'success' &&
+      needs.preflight-trust.result == 'success' &&
+      needs.release-metadata.result == 'success'
    uses: ./.github/workflows/publish-platform.yml
    with:
-      version: ${{ needs.publish-main.outputs.version }}
-      dist_tag: ${{ needs.publish-main.outputs.dist_tag }}
+      version: ${{ needs.release-metadata.outputs.version }}
+      dist_tag: ${{ needs.release-metadata.outputs.dist_tag }}
    secrets: inherit

  release:
    runs-on: ubuntu-latest
-    needs: [publish-main, publish-platform]
-    if: always() && needs.publish-main.result == 'success' && (inputs.skip_platform == true || needs.publish-platform.result == 'success')
+    needs: [release-metadata, publish-main, publish-platform]
+    if: >-
+      always() &&
+      needs.release-metadata.result == 'success' &&
+      needs.publish-main.result == 'success' &&
+      (inputs.skip_platform == true || needs.publish-platform.result == 'success')
    steps:
      - uses: actions/checkout@v4
        with:
@@ -321,7 +472,7 @@ jobs:

      - uses: oven-sh/setup-bun@v2
        with:
-          bun-version: latest
+          bun-version: "1.3.12"

      - name: Install dependencies
        run: bun install --frozen-lockfile
@@ -335,9 +486,36 @@ jobs:
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

-      - name: Apply release version to source tree
+      - name: Resolve release state
+        id: release-state
        env:
-          VERSION: ${{ needs.publish-main.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+          RELEASE_REF: ${{ github.ref_name }}
+        run: |
+          if git rev-parse -q --verify "refs/tags/v${VERSION}" >/dev/null; then
+            echo "tag_exists=true" >> "$GITHUB_OUTPUT"
+            echo "release_commit_exists=true" >> "$GITHUB_OUTPUT"
+            git checkout --detach "v${VERSION}"
+            exit 0
+          fi
+
+          echo "tag_exists=false" >> "$GITHUB_OUTPUT"
+          RELEASE_SHA=""
+          if [ -n "$RELEASE_REF" ]; then
+            RELEASE_SHA=$(git rev-list --max-count=1 --grep="^release: v${VERSION}$" "origin/${RELEASE_REF}" 2>/dev/null || true)
+          fi
+
+          if [ -n "$RELEASE_SHA" ]; then
+            echo "release_commit_exists=true" >> "$GITHUB_OUTPUT"
+            git checkout --detach "$RELEASE_SHA"
+          else
+            echo "release_commit_exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Apply release version to source tree
+        if: steps.release-state.outputs.release_commit_exists != 'true'
+        env:
+          VERSION: ${{ needs.release-metadata.outputs.version }}
        run: |
          jq --arg v "$VERSION" '.version = $v' package.json > tmp.json && mv tmp.json package.json

@@ -348,37 +526,86 @@ jobs:
          done

          jq --arg v "$VERSION" '.optionalDependencies = (.optionalDependencies | to_entries | map(.value = $v) | from_entries)' package.json > tmp.json && mv tmp.json package.json
+          jq --arg v "$VERSION" '.version = $v' packages/omo-codex/plugin/.codex-plugin/plugin.json > tmp.json && mv tmp.json packages/omo-codex/plugin/.codex-plugin/plugin.json
+          jq --arg v "$VERSION" '.version = $v' packages/omo-codex/plugin/package.json > tmp.json && mv tmp.json packages/omo-codex/plugin/package.json

      - name: Commit version bump
+        if: steps.release-state.outputs.release_commit_exists != 'true'
        env:
-          VERSION: ${{ needs.publish-main.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
        run: |
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git config user.name "github-actions[bot]"
-          git add package.json packages/oh-my-opencode-*/package.json
+          git add package.json packages/oh-my-opencode-*/package.json packages/omo-codex/plugin/.codex-plugin/plugin.json packages/omo-codex/plugin/package.json
          git diff --cached --quiet || git commit -m "release: v${VERSION}"

      - name: Create release tag
+        if: steps.release-state.outputs.tag_exists != 'true'
        env:
-          VERSION: ${{ needs.publish-main.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
        run: |
-          if git rev-parse "v${VERSION}" >/dev/null 2>&1; then
-            echo "::error::Tag v${VERSION} already exists"
-            exit 1
+          if git rev-parse -q --verify "refs/tags/v${VERSION}" >/dev/null; then
+            echo "Release tag v${VERSION} already exists locally"
+          else
+            git tag "v${VERSION}"
          fi
-          git tag "v${VERSION}"

      - name: Push release state
+        if: steps.release-state.outputs.tag_exists != 'true'
        env:
-          VERSION: ${{ needs.publish-main.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+          RELEASE_REF: ${{ github.ref_name }}
+          RELEASE_COMMIT_EXISTS: ${{ steps.release-state.outputs.release_commit_exists }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
-          git push origin HEAD
-          git push origin "v${VERSION}"
+          if [ "$RELEASE_COMMIT_EXISTS" != "true" ]; then
+            if [ -z "$RELEASE_REF" ]; then
+              echo "::error::Cannot push release commit because github.ref_name is empty."
+              exit 1
+            fi
+            git push origin "HEAD:${RELEASE_REF}"
+          else
+            echo "Release commit already exists on origin/${RELEASE_REF}"
+          fi
+
+          if git ls-remote --exit-code --tags origin "refs/tags/v${VERSION}" >/dev/null 2>&1; then
+            echo "Release tag v${VERSION} already exists on origin"
+          else
+            git push origin "v${VERSION}"
+          fi
+
+      - name: Checkout LazyCodex marketplace
+        if: inputs.publish_lazycodex == true
+        uses: actions/checkout@v4
+        with:
+          repository: code-yeongyu/lazycodex
+          path: lazycodex-marketplace
+          token: ${{ secrets.LAZYCODEX_SYNC_TOKEN }}
+          fetch-depth: 0
+
+      - name: Sync LazyCodex Codex marketplace
+        if: inputs.publish_lazycodex == true
+        env:
+          VERSION: ${{ needs.release-metadata.outputs.version }}
+        run: |
+          bun run --cwd packages/omo-codex/plugin build
+          bun run build:ast-grep-mcp
+          bun run build:lsp-tools-mcp
+          bun run script/sync-lazycodex-marketplace.ts "$GITHUB_WORKSPACE" "$GITHUB_WORKSPACE/lazycodex-marketplace"
+          cd "$GITHUB_WORKSPACE/lazycodex-marketplace"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+          git add .agents/plugins/marketplace.json plugins/omo
+          if git diff --cached --quiet; then
+            echo "LazyCodex marketplace already up to date"
+          else
+            git commit -m "chore: sync Codex marketplace v${VERSION}"
+            git push origin HEAD:main
+          fi

      - name: Create GitHub release
        env:
-          VERSION: ${{ needs.publish-main.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release view "v${VERSION}" >/dev/null 2>&1 || \
@@ -392,7 +619,7 @@ jobs:
      - name: Merge to master
        continue-on-error: true
        env:
-          VERSION: ${{ needs.publish-main.outputs.version }}
+          VERSION: ${{ needs.release-metadata.outputs.version }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git config user.name "github-actions[bot]"
@@ -18,7 +18,7 @@ jobs:

      - uses: oven-sh/setup-bun@v2
        with:
-          bun-version: latest
+          bun-version: "1.3.12"

      - name: Install dependencies
        run: bun install --frozen-lockfile
@@ -59,7 +59,7 @@ jobs:
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
-          bun-version: latest
+          bun-version: "1.3.12"

      - name: Cache Bun dependencies
        uses: actions/cache@v4
@@ -345,29 +345,31 @@ jobs:
          COMMENT_ID_VAL: ${{ github.event.comment.id }}
          REPO: ${{ github.repository }}
        run: |
-          if [[ "$EVENT_NAME" == "issue_comment" ]]; then
-            ISSUE_NUM="$ISSUE_NUMBER"
-            AUTHOR="$COMMENT_AUTHOR"
-            COMMENT_ID="$COMMENT_ID_VAL"
+          {
+            if [[ "$EVENT_NAME" == "issue_comment" ]]; then
+              ISSUE_NUM="$ISSUE_NUMBER"
+              AUTHOR="$COMMENT_AUTHOR"
+              COMMENT_ID="$COMMENT_ID_VAL"

-            # Check if PR or Issue and get title
-            ISSUE_DATA=$(gh api "repos/$REPO/issues/${ISSUE_NUM}")
-            TITLE=$(echo "$ISSUE_DATA" | jq -r '.title')
-            if echo "$ISSUE_DATA" | jq -e '.pull_request' > /dev/null; then
-              echo "type=pr" >> $GITHUB_OUTPUT
-              echo "number=${ISSUE_NUM}" >> $GITHUB_OUTPUT
-            else
-              echo "type=issue" >> $GITHUB_OUTPUT
-              echo "number=${ISSUE_NUM}" >> $GITHUB_OUTPUT
+              # Check if PR or Issue and get title
+              ISSUE_DATA=$(gh api "repos/$REPO/issues/${ISSUE_NUM}")
+              TITLE=$(echo "$ISSUE_DATA" | jq -r '.title')
+              if echo "$ISSUE_DATA" | jq -e '.pull_request' > /dev/null; then
+                echo "type=pr"
+                echo "number=${ISSUE_NUM}"
+              else
+                echo "type=issue"
+                echo "number=${ISSUE_NUM}"
+              fi
+              echo "title=${TITLE}"
            fi
-            echo "title=${TITLE}" >> $GITHUB_OUTPUT
-          fi

-          echo "comment<<EOF" >> $GITHUB_OUTPUT
-          echo "$COMMENT_BODY" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-          echo "author=$AUTHOR" >> $GITHUB_OUTPUT
-          echo "comment_id=$COMMENT_ID" >> $GITHUB_OUTPUT
+            echo "comment<<EOF"
+            echo "$COMMENT_BODY"
+            echo "EOF"
+            echo "author=$AUTHOR"
+            echo "comment_id=$COMMENT_ID"
+          } >> "$GITHUB_OUTPUT"

      # Add :eyes: reaction (as sisyphus-dev-ai)
      - name: Add eyes reaction