publish.yml

name: publish-npm

on:
  workflow_dispatch:
    inputs:
      version:
        description: Version to publish without the leading v (e.g. 1.18.0)
        required: true
        type: string
      channel:
        description: npm dist-tag / channel (latest for stable, e.g. beta for previews)
        type: string
        default: latest
      dry_run:
        description: Build and validate without publishing to npm
        type: boolean
        default: false

permissions:
  contents: read

concurrency: publish-npm-${{ inputs.version }}

jobs:
  publish:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: ./.github/actions/setup-bun

      - name: Validate version
        env:
          VERSION: ${{ inputs.version }}
        run: |
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$ ]]; then
            echo "Invalid version: $VERSION" >&2
            exit 1
          fi

      - name: Configure npm auth
        if: ${{ !inputs.dry_run }}
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          if [ -z "$NPM_TOKEN" ]; then
            echo "NPM_TOKEN secret is not set" >&2
            exit 1
          fi
          # Pin the registry so publish can't be redirected by a repo/workspace .npmrc.
          {
            echo "registry=https://registry.npmjs.org/"
            echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}"
          } > "$HOME/.npmrc"

      - name: Build and publish to npm
        working-directory: packages/opencode
        env:
          OPENCODE_CHANNEL: ${{ inputs.channel }}
          OPENCODE_VERSION: ${{ inputs.version }}
        run: bun run script/publish.ts ${{ inputs.dry_run && '--dry-run' || '' }}