Empirically the npm registry returns HTTP 201 (Created) - not 200 -
when the OIDC token exchange succeeds and a fresh publish token is
issued. The preflight gate was only accepting 200 so every
correctly-configured package was flagged as missing. Accept any
2xx status; only treat 4xx/5xx as missing trust config.
The publish workflow used to bump npm latest+1 *before* attempting
the platform publishes. When a platform package was missing its
trusted-publisher config the version was already incremented but
that platform never shipped, leaving partial-publish garbage
versions on npm (this happened with v3.17.7-v3.17.9 during the
OIDC migration).
Add a preflight-trust job that runs in parallel with test/typecheck
and verifies all 24 packages have a trusted publisher configured by
calling npm's own OIDC token exchange endpoint with the workflow's
GitHub OIDC token. publish-main now needs preflight-trust, so any
missing trust config fails the workflow before the version bump.
Failure output lists the exact npm.com URLs to configure each
missing package, plus the org/repo/workflow values to enter.
After switching to npm Trusted Publishing the publish step still
returned 'PUT 404' because actions/setup-node injects an
'//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}' line into
.npmrc. With NODE_AUTH_TOKEN unset that placeholder evaluates to
an empty string, so npm tries an empty token before reaching for
the OIDC ID token and the registry rejects it.
- Add a step that strips any _authToken line from both project-
local and $HOME/.npmrc before publishing, so npm CLI proceeds
to OIDC token exchange.
- Bump publish commands to --loglevel verbose so future failures
expose the actual auth path (provenance attestation, OIDC
exchange, etc.) in workflow logs.
NODE_AUTH_TOKEN expired (set 90 days ago, the npm token default
expiry) causing all publish runs to fail with 'PUT 404 Not Found'
since 2026-04-30.
Migrate publish.yml and publish-platform.yml to npm Trusted
Publishing (OIDC) so we no longer depend on long-lived secrets:
- Bump actions/setup-node v4 -> v6 (improves OIDC compatibility)
- Add 'npm install -g npm@latest' to guarantee npm CLI >= 11.5.1
(the minimum required for trusted publishing).
- Drop NODE_AUTH_TOKEN env from every publish step. The npm CLI
picks up the GitHub Actions OIDC token automatically.
- Keep --provenance / NPM_CONFIG_PROVENANCE=true (real-world
reports indicate provenance is not auto-emitted yet).
Per-package trusted publisher must still be configured on
npmjs.com (Settings -> Trusted Publisher) for all 24 packages
(oh-my-opencode + oh-my-openagent main + 11 platform packages
each, dual-published) before the next publish run.
Bun-compiled binaries contain a malformed LC_CODE_SIGNATURE load
command that prevents codesign from directly replacing it. Remove
the existing signature first, then apply a fresh ad-hoc signature.
Bun on github macos-latest runners does not emit linker-signed
signatures by default. Sign explicitly with 'codesign --sign -'
without preserve-metadata since the binary has no prior signature.
The previous ad-hoc codesign step failed with 'invalid or unsupported
format for signature' because it tried to preserve the 'linker-signed'
flag which cannot be re-signed. The native macOS build already produces
a valid ad-hoc signature via Bun's linker, so we only need to verify
the signature exists rather than re-sign it.
v3.16.0 binaries had 'adhoc,linker-signed' signatures because newer
Bun versions no longer emit linker-signed signatures when cross-compiling
darwin targets from Linux. Current releases have 'code object is not
signed at all', causing macOS Gatekeeper to reject them immediately.
Verified empirically:
- v3.16.0 darwin-arm64: Signature=adhoc, flags=0x20002(adhoc,linker-signed)
- v3.17.0 darwin-arm64: 'code object is not signed at all'
- Local bun build on macos: produces linker-signed signature (matches v3.16.0)
Changes:
- Route darwin-* platforms to macos-latest runner (native compile)
- Add explicit ad-hoc codesign step as belt-and-suspenders safety net
- Pin bun-version to 1.3.10 across all CI workflows to avoid
mock.module() barrel export regression introduced in 1.3.11
- Remove test:ci script from package.json (use bun test directly)
- Update publish-workflow.test.ts to expect "bun test" instead
🤖 GENERATED WITH ASSISTANCE OF OhMyOpenCode
Three test files were mocking the entire '../../shared' barrel, which
corrupted exports for subsequent test files in the same batch run.
Narrow mocks to specific submodules (logger, connected-providers-cache).
Also reverts Bun version pin since the root cause was mock scope, not Bun.
Bun 1.3.11 has a regression where mock.module() leaks across test files
in isolated batch execution, causing barrel re-exports to fail with
'Export named X not found' errors. Pin to 1.3.10 until upstream fix.
Running Linux CI in one Bun process still leaks mock.module registrations across files, so the workflows now use a CI-specific test runner that isolates mock-heavy targets before executing the remaining suite together.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
- Add afterAll(() => { mock.restore() }) to 52 test files missing cleanup
- Rewrite create-tool-guard-hooks.test.ts to use spyOn instead of barrel mock
- Fix skill-mcp-manager OAuth tests with missing mockTokens/mockLogin definitions
- Fix start-work hook: show worktree active block on resume with existing worktree_path
- Extract createWorktreeActiveBlock to worktree-block.ts to avoid circular import
- Replace 80-line isolated test runner CI config with single `bun test` command
- Add providerModelsCache/fetchAvailableModels mocks to 20 utils.test.ts
tests that broke when createBuiltinAgents started reading the cache
- Isolate ALL src/plugin and src/features/background-agent test files in CI
(mock.module pollution crosses between files in the same bun process)
- Mirror CI isolation changes in publish.yml
25 failures → 0 in CI (all mock-pollution tests run individually)
- completedTaskSummaries now includes status and error info
- notifyParentSession: noReply=false for failed tasks so parent reacts
- Batch notification distinguishes successful vs failed/cancelled tasks
- notification-template updated to show task errors
- task-poller: session-gone tests (85 new lines)
- CI: add Bun shim to PATH for legacy plugin migration tests
Apply the same mock.module() isolation fixes to publish.yml:
- Move shared and session-recovery mock-heavy tests to isolated section
- Use dynamic find + exclusion for remaining src/shared tests
- Include session-recovery tests in remaining batch
Ensures publish workflow has the same test config as main CI run.
Move 4 src/shared tests that use mock.module() to the isolated test section:
- model-capabilities.test.ts (mocks ./connected-providers-cache)
- log-legacy-plugin-startup-warning.test.ts (mocks ./legacy-plugin-warning)
- model-error-classifier.test.ts
- opencode-message-dir.test.ts
Also isolate recover-tool-result-missing.test.ts (mocks ./storage).
Use find + exclusion pattern in remaining tests to dynamically build the
src/shared file list without the isolated mock-heavy files.
Fixes 6 Linux CI failures caused by bun's mock.module() cache pollution
when running in parallel.
The publish step was updating name and optionalDependencies but not
version, causing npm to try publishing the base package.json version
(3.11.0) instead of the release version (3.12.0).
Error was: 'You cannot publish over the previously published versions: 3.11.0'
- publish-platform.yml: Build job now checks BOTH oh-my-opencode and
oh-my-openagent before skipping. Build only skips when both are published.
Added 'Publish oh-my-openagent-{platform}' step that renames package.json
and publishes under the openagent name.
- publish.yml: Added 'Publish oh-my-openagent' step after opencode publish.
Rewrites package name and optionalDependencies to oh-my-openagent variants,
then publishes. Restores package.json after.
Previously, oh-my-openagent platform packages were never published because
the build skip check only looked at oh-my-opencode (which was already published),
causing the entire build to be skipped.
Keep installer, config detection, schema generation, and publish workflows aligned with the long-lived oh-my-opencode package so this release does not split across two npm names.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
After publishing oh-my-opencode-{platform}, rename package.json and
publish oh-my-openagent-{platform} from the same build artifact.
Download/extract steps now run if either package needs publishing.
The publish-main job relied on npm trusted publishing (OIDC) which
broke after the repo rename from oh-my-opencode to oh-my-openagent.
Adding explicit NODE_AUTH_TOKEN restores auth while --provenance
still uses OIDC for Sigstore attestation.
Fixes#2373
Bun's internal download of baseline compile targets from npm registry
consistently fails on Windows CI runners (ExtractionFailed error).
Pre-download the baseline binary via curl into Bun's cache directory
so the compile step finds it already cached and skips the download.
Also makes publish job resilient with if: always() so one failed
platform doesn't block publishing all other successful platforms.
publish job now runs with if: always() && !cancelled(), and gates
each publish step on download.outcome == 'success'. One flaky target
(e.g. windows-x64-baseline) no longer blocks all other platforms.
recovery-hook.test.ts uses mock.module() at top level which patches the
executor module in the shared bun module cache. When run in the same
batch as executor.test.ts, executeCompact becomes the mocked no-op version,
causing all lock management tests to fail.
Move it to the isolated step (each file gets its own bun process) and
enumerate the remaining anthropic-context-window-limit-recovery test files
explicitly to avoid including recovery-hook.test.ts in the batch.
- Move src/tools/session-manager to isolated test section
- Prevents mock.module() pollution across parallel test runs
- Fixes 4 flaky storage tests that failed in CI
YeonGyu-Kim