chore(release): 0.9.0-next.1 (#112) #40
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v[0-9]+.[0-9]+.[0-9]+" | |
| - "v[0-9]+.[0-9]+.[0-9]+-*" | |
| # Fallback for when a tag push doesn't enqueue a run (GitHub event-delivery | |
| # gaps). Triggers are workflow-wide in Actions, so the tag input is | |
| # re-derived as RELEASE_REF_NAME (see the `ref` step) and every step below | |
| # uses that instead of GITHUB_REF_NAME; the tag is fetched and checked out | |
| # at its exact commit. | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Release tag, e.g. v0.9.0-next.0 (must exist)" | |
| required: true | |
| type: string | |
| # Default to no permissions; elevate per-job (least privilege). | |
| permissions: {} | |
| # Never run two publishes for the same release concurrently (dispatch runs | |
| # carry the branch ref, so key the group on the resolved release ref). | |
| concurrency: | |
| group: release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| name: Publish to npm + create GitHub Release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # create the GitHub Release | |
| id-token: write # npm provenance attestation | |
| steps: | |
| - name: Resolve release ref | |
| id: ref | |
| run: | | |
| if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then | |
| echo "RELEASE_REF_NAME=${{ inputs.tag }}" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "RELEASE_REF_NAME=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT" | |
| fi | |
| - uses: actions/checkout@v7 | |
| with: | |
| # Manual runs dispatch from a branch (usually main); check out the | |
| # tag's exact commit so tag and package.json agree. | |
| ref: ${{ steps.ref.outputs.RELEASE_REF_NAME }} | |
| fetch-depth: 0 | |
| - name: Set up Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22.x" | |
| registry-url: "https://registry.npmjs.org" | |
| cache: npm | |
| # Hard gate: the git tag must match the version we are about to publish. | |
| # npm publishes package.json's version regardless of the tag, so without | |
| # this a v0.2.0 tag on a 0.1.0 package.json would ship 0.1.0 silently. | |
| - name: Verify tag matches package.json version | |
| run: | | |
| PKG_VERSION="$(node -p "require('./package.json').version")" | |
| TAG_NAME="${{ steps.ref.outputs.RELEASE_REF_NAME }}" | |
| TAG_VERSION="${TAG_NAME#v}" | |
| if [[ "$PKG_VERSION" != "$TAG_VERSION" ]]; then | |
| echo "::error::tag $TAG_NAME (=$TAG_VERSION) does not match package.json version $PKG_VERSION" | |
| exit 1 | |
| fi | |
| # Guard against a contributor's global/scoped registry leaking non-npmjs | |
| # "resolved" URLs into the lockfile (which break `npm ci` in CI with E401). | |
| - name: Verify lockfile uses only the public npm registry | |
| run: | | |
| if grep -E '"resolved":[[:space:]]*"https?://' package-lock.json | grep -vq 'https://registry.npmjs.org/'; then | |
| echo "::error::package-lock.json contains non-npmjs resolved URLs:" | |
| grep -nE '"resolved":[[:space:]]*"https?://' package-lock.json | grep -v 'https://registry.npmjs.org/' || true | |
| exit 1 | |
| fi | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Typecheck, test, and build | |
| run: npm run prepublishOnly | |
| # Full integration test: install the opencode CLI, load the plugin, and | |
| # assert it lists the Cursor provider (fallback path without a key; live | |
| # discovery additionally exercised when CURSOR_API_KEY is set). | |
| - name: Integration smoke test | |
| run: bash scripts/integration-test.sh | |
| env: | |
| CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }} | |
| # A tag with a pre-release suffix (e.g. v0.1.0-rc.1) publishes to the | |
| # `next` dist-tag and is flagged as a GitHub pre-release, so `npm install` | |
| # and the repo's "Latest" release keep pointing at the last stable. | |
| - name: Classify release from tag | |
| id: version | |
| run: | | |
| TAG_NAME="${{ steps.ref.outputs.RELEASE_REF_NAME }}" | |
| VERSION="${TAG_NAME#v}" | |
| echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT" | |
| if [[ "$VERSION" == *-* ]]; then | |
| echo "NPM_TAG=next" >> "$GITHUB_OUTPUT" | |
| echo "PRERELEASE=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "NPM_TAG=latest" >> "$GITHUB_OUTPUT" | |
| echo "PRERELEASE=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Idempotent: re-running the job after a partial failure won't hard-fail | |
| # on npm's 409 for an already-published version. | |
| - name: Publish to npm | |
| run: | | |
| PKG="$(node -p "require('./package.json').name")" | |
| VER="$(node -p "require('./package.json').version")" | |
| if npm view "$PKG@$VER" version >/dev/null 2>&1; then | |
| echo "::notice::$PKG@$VER is already published; skipping publish." | |
| else | |
| npm publish --provenance --access public --tag "${{ steps.version.outputs.NPM_TAG }}" | |
| fi | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| # Dispatch runs carry the branch ref; GITHUB_REF_NAME isn't the tag | |
| # there, so pass the resolved tag explicitly. | |
| tag_name: ${{ steps.ref.outputs.RELEASE_REF_NAME }} | |
| name: "v${{ steps.version.outputs.VERSION }}" | |
| generate_release_notes: true | |
| prerelease: ${{ steps.version.outputs.PRERELEASE }} | |
| make_latest: ${{ steps.version.outputs.PRERELEASE == 'false' }} |