release.yaml

name: Release
on:
  push:
    tags:
      - "v*"
permissions:
  contents: read
  id-token: write
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false
jobs:
  # The full CI suite (build, typecheck, compatibility checks, lint, tests,
  # source evidence, the real OpenCode 2 placement run) on the exact tagged
  # commit. Publishing cannot start unless all of it passes.
  ci:
    uses: ./.github/workflows/ci.yml
  publish:
    needs: ci
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14
      - name: Verify version agreement
        env:
          RELEASE_REF: ${{ github.ref }}
        run: |
          node --input-type=module -e 'import { readFileSync } from "node:fs"; const { version } = JSON.parse(readFileSync("package.json", "utf8")); if (process.env.RELEASE_REF !== `refs/tags/v${version}`) { console.error("Tag does not match package.json version"); process.exit(1); }'
      - name: Install dependencies
        run: bun install --frozen-lockfile
      # package.json prepublishOnly: "bun run build" builds the artifact once.
      - name: Publish
        run: npm publish --access public --provenance