ci: add CI with OpenCode e2e, weekly latest-OpenCode e2e, release workflow, and Dependabot

- ci.yml: unit tests on Node 22, 24, 26 plus the end-to-end check against OpenCode 1.18.31 + 2.0.32 and 1.19.3 + 2.1.0 - e2e-latest.yml: weekly end-to-end run against the newest opencode-ai and @opencode/cli releases - release.yml: tag vX.Y.Z reruns CI and publishes with npm trusted publishing - Jobs run on GitHub only; the Gitea origin's runner skips them - Dependabot proposes grouped npm and Actions updates weekly
2026-10-20 15:10:27 +01:00
parent 17e37f2f76
commit 2a53fe2d9c
5 changed files with 238 additions and 0 deletions
@@ -0,0 +1,79 @@
+name: Release
+
+# Push a vX.Y.Z tag after bumping package.json and dating the CHANGELOG section.
+# The Verify job reruns CI, including the OpenCode 1 + 2 end-to-end check, before anything is published.
+# Publishing uses npm trusted publishing (OIDC): no npm token is stored in this repository.
+
+on:
+  push:
+    tags: ["v*.*.*"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    name: Verify
+    # GitHub only: npm trusted publishing needs GitHub's OIDC token; later jobs skip with this one.
+    if: github.server_url == 'https://github.com'
+    uses: ./.github/workflows/ci.yml
+
+  publish:
+    name: Publish to npm
+    needs: verify
+    runs-on: ubuntu-latest
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      HUSKY: "0"
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+      - name: Use npm 12 (trusted publishing needs 11.5.1 or later)
+        run: npm install -g npm@12
+      - name: Check tag, package.json, and CHANGELOG agree
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          package_version="$(node -p "require('./package.json').version")"
+          if [ "$version" != "$package_version" ]; then
+            echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $package_version"
+            exit 1
+          fi
+          node .github/scripts/changelog-section.mjs "$version" > /dev/null
+      - run: npm ci
+      - name: Publish
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          if [[ "$version" == *-* ]]; then
+            npm publish --access public --tag next
+          else
+            npm publish --access public
+          fi
+
+  github-release:
+    name: GitHub Release
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+      - name: Create release from CHANGELOG
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          node .github/scripts/changelog-section.mjs "$version" > release-notes.md
+          prerelease=""
+          if [[ "$version" == *-* ]]; then prerelease="--prerelease"; fi
+          gh release create "$GITHUB_REF_NAME" --verify-tag --title "$GITHUB_REF_NAME" --notes-file release-notes.md $prerelease