oh-my-opencode/.github/workflows/publish.yml

name: publish
run-name: "${{ format('release {0}', inputs.version || inputs.bump) }}"

on:
  workflow_dispatch:
    inputs:
      bump:
        description: "Bump major, minor, or patch"
        required: true
        type: choice
        default: patch
        options:
          - patch
          - minor
          - major
      version:
        description: "Override version (e.g., 3.0.0-beta.6). Takes precedence over bump."
        required: false
        type: string
      skip_platform:
        description: "Skip platform binary packages"
        required: false
        type: boolean
        default: false

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: write
  id-token: write
  actions: write

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.11"

      - name: Install dependencies
        run: bun install --frozen-lockfile
        env:
          BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/cli @ast-grep/napi"

      - name: Run tests
        run: bun test

  typecheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.11"

      - name: Install dependencies
        run: bun install --frozen-lockfile
        env:
          BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/cli @ast-grep/napi"

      - name: Type check
        run: bun run typecheck

  preflight-trust:
    runs-on: ubuntu-latest
    if: github.repository == 'code-yeongyu/oh-my-openagent'
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Verify trusted publisher for all 24 packages
        env:
          REPO: code-yeongyu/oh-my-openagent
          WORKFLOW_FILE: publish.yml
        run: |
          OIDC_TOKEN=$(curl -sH "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=npm:registry.npmjs.org" \
            | jq -r '.value // empty')

          if [ -z "${OIDC_TOKEN}" ]; then
            echo "::error::Failed to acquire GitHub OIDC token"
            exit 1
          fi

          PLATFORMS=(darwin-arm64 darwin-x64 darwin-x64-baseline linux-x64 linux-x64-baseline linux-arm64 linux-x64-musl linux-x64-musl-baseline linux-arm64-musl windows-x64 windows-x64-baseline)
          ALL_PACKAGES=(oh-my-opencode oh-my-openagent)
          for plat in "${PLATFORMS[@]}"; do
            ALL_PACKAGES+=("oh-my-opencode-${plat}")
            ALL_PACKAGES+=("oh-my-openagent-${plat}")
          done

          FAILED=()
          for pkg in "${ALL_PACKAGES[@]}"; do
            STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
              -X POST \
              "https://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/${pkg}" \
              -H "Authorization: Bearer ${OIDC_TOKEN}" \
              -H "Content-Type: application/json" \
              -d '{}')

            # npm returns 200 or 201 when trusted publisher is configured (token issued).
            # 404 means the package has no trusted publisher mapping for this workflow.
            if [ "${STATUS}" -ge 200 ] && [ "${STATUS}" -lt 300 ]; then
              echo "OK   ${pkg}"
            else
              echo "FAIL ${pkg} (HTTP ${STATUS})"
              FAILED+=("${pkg}")
            fi
          done

          if [ ${#FAILED[@]} -gt 0 ]; then
            {
              echo
              echo "::error::Trusted publisher not configured for ${#FAILED[@]} package(s)."
              echo "::error::Configure each below at the URL with these values:"
              echo "::error::  Provider: GitHub Actions"
              echo "::error::  Organization: code-yeongyu"
              echo "::error::  Repository: ${REPO}"
              echo "::error::  Workflow filename: ${WORKFLOW_FILE}"
              echo
              for pkg in "${FAILED[@]}"; do
                echo "::error::  https://www.npmjs.com/package/${pkg}/access"
              done
            } >&2
            exit 1
          fi

          echo
          echo "All ${#ALL_PACKAGES[@]} packages have trusted publisher configured."

  publish-main:
    runs-on: ubuntu-latest
    needs: [test, typecheck, preflight-trust]
    if: github.repository == 'code-yeongyu/oh-my-openagent'
    outputs:
      version: ${{ steps.version.outputs.version }}
      dist_tag: ${{ steps.version.outputs.dist_tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: recursive

      - run: git fetch --force --tags

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.11"

      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Upgrade npm for trusted publishing (>=11.5.1)
        run: npm install -g npm@latest

      - name: Install dependencies
        run: bun install --frozen-lockfile
        env:
          BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/cli @ast-grep/napi"

      - name: Calculate version
        id: version
        env:
          RAW_VERSION: ${{ inputs.version }}
          BUMP: ${{ inputs.bump }}
        run: |
          VERSION="$RAW_VERSION"
          if [ -z "$VERSION" ]; then
            PREV=$(curl -s https://registry.npmjs.org/oh-my-opencode/latest | jq -r '.version // "0.0.0"')
            BASE="${PREV%%-*}"
            IFS='.' read -r MAJOR MINOR PATCH <<< "$BASE"
            case "$BUMP" in
              major) VERSION="$((MAJOR+1)).0.0" ;;
              minor) VERSION="${MAJOR}.$((MINOR+1)).0" ;;
              *) VERSION="${MAJOR}.${MINOR}.$((PATCH+1))" ;;
            esac
          fi

          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z]+(\.[0-9A-Za-z]+)*)?$ ]]; then
            echo "::error::Invalid version: $VERSION"
            exit 1
          fi

          echo "version=$VERSION" >> $GITHUB_OUTPUT

          if [[ "$VERSION" == *"-"* ]]; then
            DIST_TAG=$(printf '%s' "$VERSION" | cut -d'-' -f2 | cut -d'.' -f1)
            if ! [[ "$DIST_TAG" =~ ^[a-z][a-z0-9-]*$ ]]; then
              echo "::error::Invalid dist_tag: $DIST_TAG"
              exit 1
            fi
            echo "dist_tag=${DIST_TAG:-next}" >> $GITHUB_OUTPUT
          else
            echo "dist_tag=" >> $GITHUB_OUTPUT
          fi

          echo "Version: $VERSION"

      - name: Check if already published
        id: check
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/oh-my-opencode/${VERSION}")
          if [ "$STATUS" = "200" ]; then
            echo "skip=true" >> $GITHUB_OUTPUT
            echo "✓ oh-my-opencode@${VERSION} already published"
          else
            echo "skip=false" >> $GITHUB_OUTPUT
          fi

      - name: Update version
        if: steps.check.outputs.skip != 'true'
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          jq --arg v "$VERSION" '.version = $v' package.json > tmp.json && mv tmp.json package.json

          for platform in darwin-arm64 darwin-x64 darwin-x64-baseline linux-x64 linux-x64-baseline linux-arm64 linux-x64-musl linux-x64-musl-baseline linux-arm64-musl windows-x64 windows-x64-baseline; do
            package_dir="packages/oh-my-opencode-${platform}"
            jq --arg v "$VERSION" '.version = $v' "${package_dir}/package.json" > tmp.json
            mv tmp.json "${package_dir}/package.json"
          done

          jq --arg v "$VERSION" '.optionalDependencies = (.optionalDependencies | to_entries | map(.value = $v) | from_entries)' package.json > tmp.json && mv tmp.json package.json

      - name: Build main package
        if: steps.check.outputs.skip != 'true'
        run: bun run build

      - name: Strip token auth from .npmrc to force OIDC
        if: steps.check.outputs.skip != 'true'
        run: |
          for f in .npmrc "$HOME/.npmrc"; do
            if [ -f "$f" ]; then
              sed -i.bak '/_authToken/d' "$f"
              rm -f "$f.bak"
              echo "Cleaned $f"
            fi
          done

      - name: Publish oh-my-opencode
        if: steps.check.outputs.skip != 'true'
        env:
          DIST_TAG: ${{ steps.version.outputs.dist_tag }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          if [ -n "$DIST_TAG" ]; then
            npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose
          else
            npm publish --access public --provenance --loglevel verbose
          fi

      - name: Check if oh-my-openagent already published
        id: check-openagent
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/oh-my-openagent/${VERSION}")
          if [ "$STATUS" = "200" ]; then
            echo "skip=true" >> $GITHUB_OUTPUT
            echo "✓ oh-my-openagent@${VERSION} already published"
          else
            echo "skip=false" >> $GITHUB_OUTPUT
          fi

      - name: Publish oh-my-openagent
        if: steps.check-openagent.outputs.skip != 'true'
        env:
          VERSION: ${{ steps.version.outputs.version }}
          DIST_TAG: ${{ steps.version.outputs.dist_tag }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          # Update package name, version, and optionalDependencies for oh-my-openagent
          jq --arg v "$VERSION" '
            .name = "oh-my-openagent" |
            .version = $v |
            .optionalDependencies = (
              .optionalDependencies | to_entries |
              map(.key = (.key | sub("^oh-my-opencode-"; "oh-my-openagent-")) | .value = $v) |
              from_entries
            )
          ' package.json > tmp.json && mv tmp.json package.json

          if [ -n "$DIST_TAG" ]; then
            npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose
          else
            npm publish --access public --provenance --loglevel verbose
          fi

      - name: Restore package.json
        if: always() && steps.check-openagent.outputs.skip != 'true'
        run: |
          git checkout -- package.json

  publish-platform:
    needs: publish-main
    if: inputs.skip_platform != true
    uses: ./.github/workflows/publish-platform.yml
    with:
      version: ${{ needs.publish-main.outputs.version }}
      dist_tag: ${{ needs.publish-main.outputs.dist_tag }}
    secrets: inherit

  release:
    runs-on: ubuntu-latest
    needs: [publish-main, publish-platform]
    if: always() && needs.publish-main.result == 'success' && (inputs.skip_platform == true || needs.publish-platform.result == 'success')
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - run: git fetch --force --tags

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile
        env:
          BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/cli @ast-grep/napi"

      - name: Generate changelog
        run: |
          bun run script/generate-changelog.ts > /tmp/changelog.md
          cat /tmp/changelog.md
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Apply release version to source tree
        env:
          VERSION: ${{ needs.publish-main.outputs.version }}
        run: |
          jq --arg v "$VERSION" '.version = $v' package.json > tmp.json && mv tmp.json package.json

          for platform in darwin-arm64 darwin-x64 darwin-x64-baseline linux-x64 linux-x64-baseline linux-arm64 linux-x64-musl linux-x64-musl-baseline linux-arm64-musl windows-x64 windows-x64-baseline; do
            package_dir="packages/oh-my-opencode-${platform}"
            jq --arg v "$VERSION" '.version = $v' "${package_dir}/package.json" > tmp.json
            mv tmp.json "${package_dir}/package.json"
          done

          jq --arg v "$VERSION" '.optionalDependencies = (.optionalDependencies | to_entries | map(.value = $v) | from_entries)' package.json > tmp.json && mv tmp.json package.json

      - name: Commit version bump
        env:
          VERSION: ${{ needs.publish-main.outputs.version }}
        run: |
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git config user.name "github-actions[bot]"
          git add package.json packages/oh-my-opencode-*/package.json
          git diff --cached --quiet || git commit -m "release: v${VERSION}"

      - name: Create release tag
        env:
          VERSION: ${{ needs.publish-main.outputs.version }}
        run: |
          if git rev-parse "v${VERSION}" >/dev/null 2>&1; then
            echo "::error::Tag v${VERSION} already exists"
            exit 1
          fi
          git tag "v${VERSION}"

      - name: Push release state
        env:
          VERSION: ${{ needs.publish-main.outputs.version }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git push origin HEAD
          git push origin "v${VERSION}"

      - name: Create GitHub release
        env:
          VERSION: ${{ needs.publish-main.outputs.version }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release view "v${VERSION}" >/dev/null 2>&1 || \
            gh release create "v${VERSION}" --title "v${VERSION}" --notes-file /tmp/changelog.md

      - name: Delete draft release
        run: gh release delete next --yes 2>/dev/null || true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Merge to master
        continue-on-error: true
        env:
          VERSION: ${{ needs.publish-main.outputs.version }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git stash --include-untracked || true
          git checkout master
          git reset --hard "v${VERSION}"
          git push -f origin master || echo "::warning::Failed to push to master"