main.yaml

---
name: Main

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened, ready_for_review]
  workflow_dispatch:
    inputs:
      dry-run:
        description: Dry run
        default: true
        required: false
        type: boolean

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build
        run: bun run build

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24

      - name: Verify plugin loads in Node.js
        run: |
          node --input-type=module -e "
            const m = await import('./dist/index.js');
            const exportKeys = Object.keys(m).sort();
            const expected = ['default'];
            if (JSON.stringify(exportKeys) !== JSON.stringify(expected)) {
              throw new Error('Plugin entry must export only \`default\`. Got: ' + JSON.stringify(exportKeys) + '. Extra named exports break OpenCode plugin loading (the loader treats them as additional plugin factories and crashes when invoking them with no input). Move helpers to src/lib/.');
            }
            const pluginFactory = m.default;
            if (typeof pluginFactory !== 'function') {
              throw new Error('Default export must be a function. Got: ' + typeof pluginFactory);
            }
            const plugin = await pluginFactory({
              client: { app: { log: async () => {} } },
              directory: process.cwd()
            });
            const config = { agent: {}, command: {}, skill: {} };
            await plugin.config(config);
            const agents = Object.keys(config.agent).length;
            const commands = Object.keys(config.command).length;
            if (agents === 0 || commands === 0) throw new Error('No assets loaded: ' + agents + ' agents, ' + commands + ' commands');
            console.log('Plugin loaded: ' + agents + ' agents, ' + commands + ' commands, tool: ' + (typeof plugin.tool.systematic_skill.execute));
          "

      - name: Content integrity gate
        run: bun scripts/content-integrity.ts

      - name: Registry drift check
        run: bun run registry:drift

      - name: Schema drift check
        run: bun run schema:drift

  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Typecheck
        run: bun run typecheck

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Lint codebase
        run: bun run lint

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run tests
        run: bun test tests/unit

  registry:
    name: Registry
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Validate registry
        run: bun run registry:validate

  docs:
    name: Docs Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Install Playwright Chromium
        run: bun playwright install --with-deps chromium
        working-directory: docs

      - name: Build docs
        run: bun run docs:build

  release:
    env:
      DRY_RUN: ${{ github.event_name == 'pull_request' || github.event.inputs.dry-run && 'true' || 'false' }}
    name: Release
    needs: [build, typecheck, lint, test]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      issues: write
      pull-requests: write
    steps:
      - id: get-workflow-app-token
        name: Get Workflow Application Token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.APPLICATION_ID }}
          private-key: ${{ secrets.APPLICATION_PRIVATE_KEY }}

      - id: setup-git-user
        name: Get GitHub App User ID and Setup Git user
        env:
          GH_TOKEN: ${{ steps.get-workflow-app-token.outputs.token }}
        run: |
          name="${{ steps.get-workflow-app-token.outputs.app-slug }}[bot]"
          user_id=$(gh api "/users/${name}" --jq .id)
          email="${user_id}+${name}@users.noreply.github.com"
          echo "user-email=${email}" >> "$GITHUB_OUTPUT"
          echo "user-name=${name}" >> "$GITHUB_OUTPUT"
          git config --global user.email "${email}"
          git config --global user.name "${name}"

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
          token: ${{ steps.get-workflow-app-token.outputs.token }}

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0

      - name: Setup Node.js for NPM publishing
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build
        run: bun run build

      - name: Get Release Options
        env:
          INPUT_DRY_RUN: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.dry-run && 'true' || 'false' }}
          IS_DEFAULT_BRANCH: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
        run: |
          if [[ $DRY_RUN != 'true' || $IS_DEFAULT_BRANCH == 'true' ]]; then
            echo "DRY_RUN=false" >> $GITHUB_ENV
          fi

      - name: Semantic Release
        id: semantic-release
        env:
          CI_FLAG: ${{ env.DRY_RUN == 'true' && 'false' || 'true' }}
          GIT_AUTHOR_EMAIL: ${{ steps.setup-git-user.outputs.user-email }}
          GIT_AUTHOR_NAME: ${{ steps.setup-git-user.outputs.user-name }}
          GIT_COMMITTER_EMAIL: ${{ steps.setup-git-user.outputs.user-email }}
          GIT_COMMITTER_NAME: ${{ steps.setup-git-user.outputs.user-name }}
          GITHUB_TOKEN: ${{ steps.get-workflow-app-token.outputs.token }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          npx semantic-release --dry-run ${{ env.DRY_RUN }} --ci ${{ env.CI_FLAG }}
        shell: 'bash -Eeuxo pipefail {0}'