publish.yaml

name: Publish

on:
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Validate and pack without publishing"
        required: false
        type: boolean
        default: true
  release:
    types: [published]

permissions:
  contents: read
  id-token: write # required for npm Trusted Publishing (OIDC) + provenance

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  npm:
    name: Publish opencode packages
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up pnpm
        uses: pnpm/action-setup@v4

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
          cache: pnpm

      # Trusted Publishing (OIDC) is an npm-CLI feature and needs npm >= 11.5.1.
      # We publish with `npm` (not `pnpm`) so the OIDC token exchange happens; no
      # NPM token is configured — auth comes from the OIDC id-token above.
      - name: Upgrade npm (trusted publishing support)
        run: npm install -g npm@latest

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      - name: Validate opencode entrypoints
        run: pnpm run validate:opencode

      - name: Validate manifest versions
        run: scripts/validate-manifests.sh

      - name: Pack opencode packages (validate)
        run: |
          for dir in \
            plugins/xberg \
            plugins/crawlberg \
            plugins/html-to-markdown \
            plugins/tree-sitter-language-pack; do
            echo "::group::pack $dir"
            (cd "$dir" && npm publish --dry-run --access public)
            echo "::endgroup::"
          done

      - name: Publish opencode packages (Trusted Publishing + provenance)
        if: ${{ github.event_name == 'release' || inputs.dry_run != true }}
        run: |
          for dir in \
            plugins/xberg \
            plugins/crawlberg \
            plugins/html-to-markdown \
            plugins/tree-sitter-language-pack; do
            name="$(node -p "require('./$dir/package.json').name")"
            ver="$(node -p "require('./$dir/package.json').version")"
            if npm view "${name}@${ver}" version >/dev/null 2>&1; then
              echo "skip ${name}@${ver} (already on npm)"
              continue
            fi
            echo "::group::publish ${name}@${ver}"
            (cd "$dir" && npm publish --access public --provenance)
            echo "::endgroup::"
          done