publish-sdk #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: publish-sdk | |
| # Phase 2 — publish @botiverse/kimi-code-sdk to npm via OIDC trusted publishing. | |
| # | |
| # Design (tygg, #proj-runtime:626b08f7 6/13): OIDC trusted publishing (NO long-lived | |
| # NPM_TOKEN), TAG-triggered, human/agent IN THE LOOP (not fully auto on every upstream | |
| # release — Kai writes the release note + decides, then pushes the publish tag). | |
| # | |
| # HOW TO PUBLISH (maintainer = Kai): | |
| # 1. Pick the upstream mirror tag to ship, e.g. @moonshot-ai/kimi-code@0.14.2 | |
| # (node-sdk's own version at that tag = the npm version, e.g. 0.9.3 — see RELEASES.md). | |
| # 2. Write/confirm the interface release note (GitHub Release + RELEASES.md). | |
| # 3. Put a publish tag on that SAME upstream-source commit and push it: | |
| # git tag publish-sdk/v0.9.3 '@moonshot-ai/kimi-code@0.14.2' # same commit = upstream source | |
| # git push botiverse publish-sdk/v0.9.3 | |
| # The workflow checks out that source, builds node-sdk, repackages, and publishes. | |
| # The tag suffix (v0.9.3) MUST equal node-sdk's package.json version at that source — the | |
| # job asserts it and fails closed on mismatch. | |
| # | |
| # ONE-TIME HUMAN SETUP (cannot be done from CI/non-interactively): | |
| # - npmjs.com → @botiverse/kimi-code-sdk → configure Trusted Publisher: | |
| # repo = botiverse/kimi-code-sdk, workflow = publish-sdk.yml, (optional) environment = npm-publish. | |
| # - If the package does not exist yet, npm trusted publishing for a brand-new name may need a | |
| # first bootstrap publish by a logged-in @botiverse maintainer (then OIDC for every release after). | |
| # - (Optional) create a protected GitHub Environment `npm-publish` with required reviewers | |
| # = the manual approval gate ("participate in it") before the publish step runs. | |
| on: | |
| push: | |
| tags: | |
| - 'publish-sdk/v*' # deliberate publish tag pushed by Kai (in the loop) | |
| workflow_dispatch: | |
| inputs: | |
| source_tag: | |
| description: 'Upstream mirror tag to build from, e.g. @moonshot-ai/kimi-code@0.14.2' | |
| required: true | |
| npm_version: | |
| description: 'npm package version to publish (default = upstream node-sdk pkg.version; override when bundled-implementation refresh warrants a Botiverse-side patch-bump)' | |
| required: false | |
| default: '' | |
| dry_run: | |
| description: 'Dry run (build + pack + publish --dry-run, no real publish)' | |
| type: boolean | |
| default: true | |
| permissions: | |
| contents: read | |
| id-token: write # OIDC trusted publishing + provenance attestation | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| environment: npm-publish # optional manual-approval gate (create the env to require review) | |
| steps: | |
| - name: Resolve build ref + intent | |
| id: resolve | |
| run: | | |
| if [ "${{ github.event_name }}" = "push" ]; then | |
| # publish tag points at the upstream-source commit; checking it out gives the source. | |
| echo "build_ref=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT" | |
| echo "expected_version=${GITHUB_REF_NAME#publish-sdk/v}" >> "$GITHUB_OUTPUT" | |
| echo "dry_run=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "build_ref=${{ inputs.source_tag }}" >> "$GITHUB_OUTPUT" | |
| echo "expected_version=${{ inputs.npm_version }}" >> "$GITHUB_OUTPUT" | |
| echo "dry_run=${{ inputs.dry_run }}" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Checkout upstream source at build ref | |
| uses: actions/checkout@v5 | |
| with: | |
| ref: ${{ steps.resolve.outputs.build_ref }} | |
| fetch-depth: 1 | |
| - name: Checkout our scripts (main) | |
| uses: actions/checkout@v5 | |
| with: | |
| ref: main | |
| path: .mirror-main | |
| fetch-depth: 1 | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: 24 # kimi-code's package.json sets engines.node ">=24.15.0" | |
| registry-url: 'https://registry.npmjs.org' | |
| # v5 enabled package-manager auto-cache by default; it tries to resolve pnpm | |
| # before we corepack-enable it later in the job. Disable so corepack stays the | |
| # source of truth (we pin pnpm via kimi-code's `packageManager` field). | |
| package-manager-cache: false | |
| - name: Use npm with OIDC trusted-publishing support | |
| run: npm install -g npm@latest # trusted publishing needs npm >= 11.5 | |
| - name: Build node-sdk (scoped install of its closure only) | |
| run: | | |
| corepack enable | |
| pnpm install --frozen-lockfile --filter "@moonshot-ai/kimi-code-sdk..." | |
| pnpm --filter @moonshot-ai/kimi-code-sdk build | |
| - name: Compare tag version vs node-sdk source version | |
| if: steps.resolve.outputs.expected_version != '' | |
| id: version_check | |
| run: | | |
| SRC_VER=$(node -p "require('./packages/node-sdk/package.json').version") | |
| EXP="${{ steps.resolve.outputs.expected_version }}" | |
| if [ "$SRC_VER" = "$EXP" ]; then | |
| echo "match: tag v$EXP == source $SRC_VER (no override)" | |
| echo "override=" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "::notice::publish tag v$EXP differs from upstream node-sdk source $SRC_VER — publishing as Botiverse-side override (independent npm cadence; see RELEASES.md mapping table)." | |
| echo "override=$EXP" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Repackage -> @botiverse/kimi-code-sdk | |
| run: node .mirror-main/scripts/repackage-sdk.mjs packages/node-sdk ./.out-sdk "${{ steps.resolve.outputs.build_ref }}" "${{ steps.version_check.outputs.override }}" | |
| - name: Pack + publish | |
| working-directory: ./.out-sdk | |
| run: | | |
| npm pack | |
| # Pre-release versions (e.g. `0.18.0-botiverse.0`) require an explicit | |
| # dist-tag so they don't move `latest`. Mirror-side surface extensions | |
| # carry the `-botiverse.<n>` suffix per RELEASES.md versioning policy | |
| # (revised 2026-06-20). Stable upstream-tag publishes still get | |
| # `latest` by default. | |
| NPM_VER="$(node -p 'require("./package.json").version')" | |
| PUBLISH_TAG_ARGS="" | |
| case "$NPM_VER" in | |
| *-botiverse.*) PUBLISH_TAG_ARGS="--tag botiverse" ;; | |
| *-*) PUBLISH_TAG_ARGS="--tag pre" ;; | |
| *) PUBLISH_TAG_ARGS="" ;; | |
| esac | |
| if [ "${{ steps.resolve.outputs.dry_run }}" = "true" ]; then | |
| echo "DRY RUN — publish --dry-run only (tag: ${PUBLISH_TAG_ARGS:-latest})" | |
| npm publish --dry-run --access public $PUBLISH_TAG_ARGS | |
| else | |
| # OIDC trusted publishing: no NODE_AUTH_TOKEN; npm resolves identity from id-token. | |
| echo "publishing $NPM_VER (tag: ${PUBLISH_TAG_ARGS:-latest})" | |
| npm publish --access public --provenance $PUBLISH_TAG_ARGS | |
| fi |