Merge remote-tracking branch 'upstream/dev' into sync/fork-dev

Author: anduimagui

.github/actions/setup-bun/action.yml

@@ -1,10 +1,5 @@
 name: "Setup Bun"
 description: "Setup Bun with caching and install dependencies"
-inputs:
-  cross-compile:
-    description: "Pre-cache canary cross-compile binaries for all targets"
-    required: false
-    default: "false"
 runs:
   using: "composite"
   steps:
@@ -21,12 +16,13 @@ runs:
       shell: bash
       run: |
         if [ "$RUNNER_ARCH" = "X64" ]; then
+          V=$(node -p "require('./package.json').packageManager.split('@')[1]")
           case "$RUNNER_OS" in
             macOS)   OS=darwin ;;
             Linux)   OS=linux ;;
             Windows) OS=windows ;;
           esac
-          echo "url=https://github.com/oven-sh/bun/releases/download/canary/bun-${OS}-x64-baseline.zip" >> "$GITHUB_OUTPUT"
+          echo "url=https://github.com/oven-sh/bun/releases/download/bun-v${V}/bun-${OS}-x64-baseline.zip" >> "$GITHUB_OUTPUT"
         fi
 
     - name: Setup Bun
@@ -35,53 +31,9 @@ runs:
         bun-version-file: ${{ !steps.bun-url.outputs.url && 'package.json' || '' }}
         bun-download-url: ${{ steps.bun-url.outputs.url }}
 
-    - name: Pre-cache canary cross-compile binaries
-      if: inputs.cross-compile == 'true'
+    - name: Install setuptools for distutils compatibility
+      run: python3 -m pip install setuptools || pip install setuptools || true
       shell: bash
-      run: |
-        BUN_VERSION=$(bun --revision)
-        if echo "$BUN_VERSION" | grep -q "canary"; then
-          SEMVER=$(echo "$BUN_VERSION" | sed 's/^\([0-9]*\.[0-9]*\.[0-9]*\).*/\1/')
-          echo "Bun version: $BUN_VERSION (semver: $SEMVER)"
-          CACHE_DIR="$HOME/.bun/install/cache"
-          mkdir -p "$CACHE_DIR"
-          TMP_DIR=$(mktemp -d)
-          for TARGET in linux-aarch64 linux-x64 linux-x64-baseline linux-aarch64-musl linux-x64-musl linux-x64-musl-baseline darwin-aarch64 darwin-x64 windows-x64 windows-x64-baseline; do
-            DEST="$CACHE_DIR/bun-${TARGET}-v${SEMVER}"
-            if [ -f "$DEST" ]; then
-              echo "Already cached: $DEST"
-              continue
-            fi
-            URL="https://github.com/oven-sh/bun/releases/download/canary/bun-${TARGET}.zip"
-            echo "Downloading $TARGET from $URL"
-            if curl -sfL -o "$TMP_DIR/bun.zip" "$URL"; then
-              unzip -qo "$TMP_DIR/bun.zip" -d "$TMP_DIR"
-              if echo "$TARGET" | grep -q "windows"; then
-                BIN_NAME="bun.exe"
-              else
-                BIN_NAME="bun"
-              fi
-              mv "$TMP_DIR/bun-${TARGET}/$BIN_NAME" "$DEST"
-              chmod +x "$DEST"
-              rm -rf "$TMP_DIR/bun-${TARGET}" "$TMP_DIR/bun.zip"
-              echo "Cached: $DEST"
-              # baseline bun resolves "bun-darwin-x64" to the baseline cache key
-              # so copy the modern binary there too
-              if [ "$TARGET" = "darwin-x64" ]; then
-                BASELINE_DEST="$CACHE_DIR/bun-darwin-x64-baseline-v${SEMVER}"
-                if [ ! -f "$BASELINE_DEST" ]; then
-                  cp "$DEST" "$BASELINE_DEST"
-                  echo "Cached (baseline alias): $BASELINE_DEST"
-                fi
-              fi
-            else
-              echo "Skipped: $TARGET (not available)"
-            fi
-          done
-          rm -rf "$TMP_DIR"
-        else
-          echo "Not a canary build ($BUN_VERSION), skipping pre-cache"
-        fi
 
     - name: Install dependencies
       run: bun install

.github/workflows/beta.yml

@@ -27,7 +27,11 @@ jobs:
           opencode-app-id: ${{ vars.OPENCODE_APP_ID }}
           opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }}
 
+      - name: Install OpenCode
+        run: bun i -g opencode-ai
+
       - name: Sync beta branch
         env:
           GH_TOKEN: ${{ steps.setup-git-committer.outputs.token }}
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
         run: bun script/beta.ts

.github/workflows/docs-locale-sync.yml

@@ -47,60 +47,26 @@ jobs:
             echo "EOF"
           } >> "$GITHUB_OUTPUT"
 
+      - name: Install OpenCode
+        if: steps.changes.outputs.has_changes == 'true'
+        run: curl -fsSL https://opencode.ai/install | bash
+
       - name: Sync locale docs with OpenCode
         if: steps.changes.outputs.has_changes == 'true'
-        uses: sst/opencode/github@latest
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          GITHUB_TOKEN: ${{ steps.committer.outputs.token }}
           OPENCODE_CONFIG_CONTENT: |
             {
               "permission": {
                 "*": "deny",
-                "read": {
-                  "*": "deny",
-                  "packages/web/src/content/docs": "allow",
-                  "packages/web/src/content/docs/*": "allow",
-                  "packages/web/src/content/docs/*.mdx": "allow",
-                  "packages/web/src/content/docs/*/*.mdx": "allow",
-                  ".opencode": "allow",
-                  ".opencode/agent": "allow",
-                  ".opencode/agent/glossary": "allow",
-                  ".opencode/agent/translator.md": "allow",
-                  ".opencode/agent/glossary/*.md": "allow"
-                },
-                "edit": {
-                  "*": "deny",
-                  "packages/web/src/content/docs/*/*.mdx": "allow"
-                },
-                "glob": {
-                  "*": "deny",
-                  "packages/web/src/content/docs*": "allow",
-                  ".opencode/agent/glossary*": "allow"
-                },
-                "task": {
-                  "*": "deny",
-                  "translator": "allow"
-                }
-              },
-              "agent": {
-                "translator": {
-                  "permission": {
-                    "*": "deny",
-                    "read": {
-                      "*": "deny",
-                      ".opencode/agent/translator.md": "allow",
-                      ".opencode/agent/glossary/*.md": "allow"
-                    }
-                  }
-                }
+                "read": "allow",
+                "edit": "allow",
+                "glob": "allow",
+                "task": "allow"
               }
             }
-        with:
-          model: opencode/gpt-5.3-codex
-          agent: docs
-          use_github_token: true
-          prompt: |
+        run: |
+          opencode run --agent docs --model opencode/gpt-5.3-codex <<'EOF'
             Update localized docs to match the latest English docs changes.
 
             Changed English doc files:
@@ -118,6 +84,7 @@ jobs:
             7. Keep locale docs structure aligned with their corresponding English pages.
             8. Do not modify English source docs in packages/web/src/content/docs/*.mdx.
             9. If no locale updates are needed, make no changes.
+          EOF
 
       - name: Commit and push locale docs updates
         if: steps.changes.outputs.has_changes == 'true'

.github/workflows/publish.yml

@@ -77,8 +77,6 @@ jobs:
           fetch-tags: true
 
       - uses: ./.github/actions/setup-bun
-        with:
-          cross-compile: "true"
 
       - name: Setup git committer
         id: committer
@@ -90,7 +88,7 @@ jobs:
       - name: Build
         id: build
         run: |
-          ./packages/opencode/script/build.ts --all
+          ./packages/opencode/script/build.ts
         env:
           OPENCODE_VERSION: ${{ needs.version.outputs.version }}
           OPENCODE_RELEASE: ${{ needs.version.outputs.release }}
@@ -101,7 +99,6 @@ jobs:
         with:
           name: opencode-cli
           path: packages/opencode/dist
-
     outputs:
       version: ${{ needs.version.outputs.version }}
 
@@ -242,11 +239,131 @@ jobs:
           APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
           APPLE_API_KEY_PATH: ${{ runner.temp }}/apple-api-key.p8
 
+  build-electron:
+    needs:
+      - build-cli
+      - version
+    continue-on-error: false
+    strategy:
+      fail-fast: false
+      matrix:
+        settings:
+          - host: macos-latest
+            target: x86_64-apple-darwin
+            platform_flag: --mac --x64
+          - host: macos-latest
+            target: aarch64-apple-darwin
+            platform_flag: --mac --arm64
+          - host: "blacksmith-4vcpu-windows-2025"
+            target: x86_64-pc-windows-msvc
+            platform_flag: --win
+          - host: "blacksmith-4vcpu-ubuntu-2404"
+            target: x86_64-unknown-linux-gnu
+            platform_flag: --linux
+          - host: "blacksmith-4vcpu-ubuntu-2404"
+            target: aarch64-unknown-linux-gnu
+            platform_flag: --linux
+    runs-on: ${{ matrix.settings.host }}
+    # if: github.ref_name == 'beta'
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: apple-actions/import-codesign-certs@v2
+        if: runner.os == 'macOS'
+        with:
+          keychain: build
+          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
+          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+
+      - name: Setup Apple API Key
+        if: runner.os == 'macOS'
+        run: echo "${{ secrets.APPLE_API_KEY_PATH }}" > $RUNNER_TEMP/apple-api-key.p8
+
+      - uses: ./.github/actions/setup-bun
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: Cache apt packages
+        if: contains(matrix.settings.host, 'ubuntu')
+        uses: actions/cache@v4
+        with:
+          path: ~/apt-cache
+          key: ${{ runner.os }}-${{ matrix.settings.target }}-apt-electron-${{ hashFiles('.github/workflows/publish.yml') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ matrix.settings.target }}-apt-electron-
+
+      - name: Install dependencies (ubuntu only)
+        if: contains(matrix.settings.host, 'ubuntu')
+        run: |
+          mkdir -p ~/apt-cache && chmod -R a+rw ~/apt-cache
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends -o dir::cache::archives="$HOME/apt-cache" rpm
+          sudo chmod -R a+rw ~/apt-cache
+
+      - name: Setup git committer
+        id: committer
+        uses: ./.github/actions/setup-git-committer
+        with:
+          opencode-app-id: ${{ vars.OPENCODE_APP_ID }}
+          opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }}
+
+      - name: Prepare
+        run: bun ./scripts/prepare.ts
+        working-directory: packages/desktop-electron
+        env:
+          OPENCODE_VERSION: ${{ needs.version.outputs.version }}
+          OPENCODE_CHANNEL: ${{ (github.ref_name == 'beta' && 'beta') || 'prod' }}
+          RUST_TARGET: ${{ matrix.settings.target }}
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_RUN_ID: ${{ github.run_id }}
+
+      - name: Build
+        run: bun run build
+        working-directory: packages/desktop-electron
+        env:
+          OPENCODE_CHANNEL: ${{ (github.ref_name == 'beta' && 'beta') || 'prod' }}
+
+      - name: Package and publish
+        if: needs.version.outputs.release
+        run: npx electron-builder ${{ matrix.settings.platform_flag }} --publish always --config electron-builder.config.ts
+        working-directory: packages/desktop-electron
+        timeout-minutes: 60
+        env:
+          OPENCODE_CHANNEL: ${{ (github.ref_name == 'beta' && 'beta') || 'prod' }}
+          GH_TOKEN: ${{ steps.committer.outputs.token }}
+          CSC_LINK: ${{ secrets.APPLE_CERTIFICATE }}
+          CSC_KEY_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_API_KEY: ${{ runner.temp }}/apple-api-key.p8
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+
+      - name: Package (no publish)
+        if: ${{ !needs.version.outputs.release }}
+        run: npx electron-builder ${{ matrix.settings.platform_flag }} --publish never --config electron-builder.config.ts
+        working-directory: packages/desktop-electron
+        timeout-minutes: 60
+        env:
+          OPENCODE_CHANNEL: ${{ (github.ref_name == 'beta' && 'beta') || 'prod' }}
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: opencode-electron-${{ matrix.settings.target }}
+          path: packages/desktop-electron/dist/*
+
+      - uses: actions/upload-artifact@v4
+        if: needs.version.outputs.release
+        with:
+          name: latest-yml-${{ matrix.settings.target }}
+          path: packages/desktop-electron/dist/latest*.yml
+
   publish:
     needs:
       - version
       - build-cli
       - build-tauri
+      - build-electron
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v3
@@ -283,6 +400,12 @@ jobs:
           name: opencode-cli
           path: packages/opencode/dist
 
+      - uses: actions/download-artifact@v4
+        if: needs.version.outputs.release
+        with:
+          pattern: latest-yml-*
+          path: /tmp/latest-yml
+
       - name: Cache apt packages (AUR)
         uses: actions/cache@v4
         with:
@@ -310,3 +433,4 @@ jobs:
           GITHUB_TOKEN: ${{ steps.committer.outputs.token }}
           GH_REPO: ${{ needs.version.outputs.repo }}
           NPM_CONFIG_PROVENANCE: false
+          LATEST_YML_DIR: /tmp/latest-yml

.github/workflows/sign-cli.yml

@@ -20,12 +20,10 @@ jobs:
           fetch-tags: true
 
       - uses: ./.github/actions/setup-bun
-        with:
-          cross-compile: "true"
 
       - name: Build
         run: |
-          ./packages/opencode/script/build.ts --all
+          ./packages/opencode/script/build.ts
 
       - name: Upload unsigned Windows CLI
         id: upload_unsigned_windows_cli