cursor-opencode-provider/.github/workflows/publish.yml at main · oakimov/cursor-opencode-provider · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
# Publish to npm via Trusted Publishing (OIDC) — no long-lived npm token.
#
# Trusted publishing authenticates each publish with a short-lived OIDC token
# minted by GitHub Actions, so no NPM_TOKEN secret is required. Provenance
# attestations are generated automatically (requires a public repo + public
# package). Requires npm CLI >= 11.5.1 and Node >= 22.14.0 in CI.
#
# Setup (one-time, per package — trusted publishing needs the package to exist):
#   1. First publish is done locally to create the package:
#        npm publish            # logged in as oakimov, 2FA prompt
#   2. Register this workflow as a trusted publisher (package now exists):
#        npm install -g npm@^11.15.0          # npm trust needs >= 11.15.0
#        npm trust github cursor-opencode-provider \
#          --file publish.yml \
#          --repository oakimov/cursor-opencode-provider \
#          --allow-publish -y
#      ...or do it via the website: npmjs.com → package → Settings →
#      Trusted Publisher → GitHub Actions (owner oakimov, repo
#      cursor-opencode-provider, workflow publish.yml, allow "npm publish").
#
# Publish flow (after setup):
#   - Bump "version" in package.json, commit to main.
#   - Push a tag matching the version (e.g. git tag v0.1.2 && git push --tags).
#   - This workflow runs install → refresh Cursor pricing → coverage check →
#     typecheck → test → build → npm publish (OIDC).
#   - Pricing is regenerated from https://cursor.com/docs/models-and-pricing.md
#     in CI so the published dist/ snapshot matches current docs. The refreshed
#     src/pricing-data.ts is used for that release build only (not committed).
#
# If OIDC publish fails with ENEEDAUTH, check that the workflow filename
# (publish.yml), repository (oakimov/cursor-opencode-provider), and the
# package.json "repository.url" all match what's registered on npm.

name: Publish

on:
  push:
    tags:
      - 'v*'

permissions:
  id-token: write   # required for OIDC trusted publishing
  contents: read

jobs:
  publish:
    name: Publish to npm
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2

      - name: Setup Node + npm registry
        uses: actions/setup-node@v6
        # Node 24 bundles npm 11.x — trusted publishing (OIDC) needs npm >= 11.5.1.
        # Node 22 bundles npm 10.x, which predates trusted publishing.
        with:
          node-version: '24'
          registry-url: https://registry.npmjs.org
          package-manager-cache: false   # never cache in release builds

      - name: Install
        run: bun install --frozen-lockfile

      # OpenCode's default interactive shell is zsh; shell-timeout's ZDOTDIR
      # injector integration test needs /bin/zsh (absent on stock ubuntu-latest).
      - name: Install zsh
        run: sudo apt-get update && sudo apt-get install -y zsh

      # Refresh bundled token rates from Cursor docs before validating/building
      # so npm releases do not ship a stale pricing-data.ts snapshot.
      - name: Refresh Cursor pricing
        run: bun run generate:pricing

      - name: Check pricing coverage
        run: bun run check:pricing

      - name: Typecheck
        run: bun run typecheck

      - name: Test
        run: bun test

      - name: Build
        run: bun run build

      - name: Publish
        run: npm publish