release.yaml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Version to publish, without leading v"
        required: true
      ref:
        description: "Release tag to publish from, such as v1.24.0"
        required: true

concurrency:
  group: release-${{ github.ref }}-${{ github.event.inputs.version || '' }}
  cancel-in-progress: false

permissions:
  contents: write
  id-token: write

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  windows:
    name: Windows packed setup
    uses: ./.github/workflows/windows.yml
    with:
      ref: ${{ github.event.inputs.ref || github.ref }}
      version: ${{ github.event.inputs.version || github.ref_name }}
    permissions:
      contents: read
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.inputs.ref || github.ref }}
          fetch-depth: 0

      - uses: actions/setup-node@v6
        with:
          node-version: "24"

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Verify workspace lockfile
        run: bun run check:workspace-lock

      - name: TypeScript typecheck
        run: bun run typecheck

      - name: Build
        run: bun run build

      - name: Pi host-import guard tests
        run: bun test scripts/check-pi-dist-imports.test.ts

      - name: Windows receipt and runtime packaging tests
        run: bun test scripts/windows packages/opencode/scripts/runtime-packaging.test.ts

      - name: Pi host-import guard
        run: bun run check:pi-dist-imports

      - name: Packed TUI smoke test
        run: bun run --cwd packages/opencode smoke:tui
        env:
          TUI_SMOKE_SKIP_BUILD: "1"

      - name: Claustrum golden provenance
        run: bun run check:claustrum-golden
        env:
          GITHUB_TOKEN: ${{ github.token }}

      - name: Test floor gate tests
        run: bun test scripts/check-test-count-floors.test.ts

      - name: Test and release floor ratchet
        # HEAD^ may already carry a lowered floor from an earlier direct push.
        # Require the checked-out tag and compare with the preceding release tag.
        env:
          CANDIDATE_REF: ${{ github.event.inputs.ref || github.ref_name }}
          CANDIDATE_VERSION: ${{ github.event.inputs.version || github.ref_name }}
        run: |
          VERSION="${CANDIDATE_VERSION#v}"
          bun scripts/check-test-count-floors.ts --release-ref "$CANDIDATE_REF" --release-version "$VERSION"

      - name: Pi host tool round-trip
        run: bun run test:pi-host

      - name: Install OpenCode CLI for e2e
        run: npm install -g opencode-ai@1.17.13

      - name: E2E tests
        run: bun run test:e2e

      - name: Format check
        run: bun run format:check

      - name: Lint
        run: bun run lint

  publish-npm:
    name: Publish ${{ matrix.package }} to npm
    runs-on: ubuntu-latest
    needs: [test, windows]
    strategy:
      fail-fast: false
      matrix:
        include:
          - package: "@cortexkit/anthropic-auth-core"
          - package: "@cortexkit/opencode-anthropic-auth"
          - package: "@cortexkit/pi-anthropic-auth"
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.inputs.ref || github.ref }}

      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Ensure latest npm (for trusted publishing)
        run: npm install -g npm@latest

      - name: Resolve release version
        id: version
        env:
          REQUESTED_VERSION: ${{ github.event.inputs.version || github.ref_name }}
        run: |
          VERSION="$REQUESTED_VERSION"
          VERSION="${VERSION#v}"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"

      - name: Download verified package tarballs
        uses: actions/download-artifact@v8
        with:
          name: anthropic-release-packages
          path: ${{ runner.temp }}/anthropic-packed

      - name: Check whether package version is already published
        id: published
        run: |
          if npm view "${{ matrix.package }}@${{ steps.version.outputs.version }}" version >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
            echo "${{ matrix.package }}@${{ steps.version.outputs.version }} is already published; skipping."
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      # Uses npm Trusted Publishing (OIDC) configured on npmjs.com.
      # Each package runs in a separate matrix job so npm obtains a package-scoped
      # OIDC publish token for that package instead of reusing the previous one.
      - name: Publish package to npm
        if: steps.published.outputs.exists != 'true'
        env:
          PACKAGE_NAME: ${{ matrix.package }}
          PACKAGE_VERSION: ${{ steps.version.outputs.version }}
        run: |
          PACKAGE_FILE="${PACKAGE_NAME#@}"
          PACKAGE_FILE="${PACKAGE_FILE//\//-}"
          TARBALL="$RUNNER_TEMP/anthropic-packed/${PACKAGE_FILE}-${PACKAGE_VERSION}.tgz"
          test -f "$TARBALL"
          npm publish "$TARBALL" --ignore-scripts --access public --provenance

  github-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [test, windows]
    if: github.event_name == 'push'
    steps:
      - uses: actions/checkout@v7

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          generate_release_notes: true