ci-pre-publish.yml

name: CI Pre-publish Checks

on:
  workflow_call:
    inputs:
      version:
        description: 'Version being released (for logging)'
        required: false
        type: string
      ref:
        description: 'Git ref (tag or branch) to checkout'
        required: false
        type: string
        # If not provided, defaults to the commit that triggered the workflow

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  check:
    name: Pre-publish Checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          # If ref is not provided, checkout defaults to the commit that triggered the workflow
          ref: ${{ inputs.ref }}

      - name: Initialize opencode submodule
        run: |
          git -c url."https://github.com/".insteadOf=git@github.com: submodule update --init --recursive packages/opencode
          git submodule status --recursive

      - name: Install Linux system dependencies
        run: |
          # Required by opencode-broker (libpam-sys links against -lpam).
          sudo apt-get update
          sudo apt-get install -y libpam0g-dev

      - name: Log version
        if: inputs.version != ''
        run: echo "Running checks for version ${{ inputs.version }}"

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Install just
        uses: extractions/setup-just@v3

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: '20'

      - name: Setup Bun
        uses: ./.github/actions/setup-bun

      - name: Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Configure git identity
        run: |
          git config --global user.email "bot@opencode.ai"
          git config --global user.name "opencode"

      - name: Verify bun.lock hash integrity
        run: |
          set -euo pipefail
          stored="$(bun pm hash-print | tr -d '\r\n')"
          computed="$(bun pm hash | tr -d '\r\n')"
          if [ -z "${stored}" ] || [ -z "${computed}" ]; then
            echo "Failed to compute bun.lock hash."
            exit 1
          fi
          if [ "${stored}" != "0000000000000000-0000000000000000-0000000000000000-0000000000000000" ] && [ "${stored}" != "${computed}" ]; then
            echo "bun.lock hash mismatch."
            echo "stored:   ${stored}"
            echo "computed: ${computed}"
            exit 1
          fi
          git diff --exit-code -- bun.lock

      - name: Audit dependencies
        run: bun audit --audit-level=high

      - name: Run opencode guardrails
        run: just check-opencode-guardrails

      # Project checks should run via shared just targets.
      - name: Run CI checks
        run: just ci-checks