cli/.github/workflows/publish.yml at main · modelstudioai/cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
name: Publish

on:
  workflow_dispatch:
    inputs:
      package:
        description: "Which package set to publish"
        required: true
        type: choice
        options:
          - bailian-cli
          - knowledge-studio-cli
      mode:
        description: "Publish mode"
        required: true
        type: choice
        options:
          - channel
          - stable
      channel:
        description: "Required when mode=channel. npm dist-tag only (lowercase, digits, dashes), e.g. mcp / plugin / sync-release. bailian-cli binary CDN always overwrites sync-release.json; knowledge-studio-cli is npm-only."
        required: false
        type: string

concurrency:
  group: publish-${{ inputs.package }}-${{ inputs.mode }}-${{ inputs.channel }}
  cancel-in-progress: false

jobs:
  publish-stable:
    if: inputs.mode == 'stable'
    name: publish stable (${{ inputs.package }}) to npm + binary + tag
    runs-on: ubuntu-latest
    environment: production # Required Reviewers gate
    permissions:
      contents: write # push tag + create GitHub Release with binary assets
      id-token: write # OIDC for npm Trusted Publishing + provenance
    steps:
      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          cache: pnpm
          registry-url: "https://registry.npmjs.org/"

      - name: Install gitleaks
        run: |
          set -euo pipefail
          GITLEAKS_VERSION=8.21.2
          curl -sSfL \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            | sudo tar -xz -C /usr/local/bin gitleaks
          gitleaks version

      - name: Ensure zip (per-platform binary archives)
        run: sudo apt-get update && sudo apt-get install -y zip

      - run: pnpm install --frozen-lockfile

      # Binary compile uses `bun build --compile` CLI (not Bun.build API).
      # Keep this pin in sync with any local smoke tests of binary-compile.mjs.
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.2.19"

      - name: publish-stable
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # OSS release channel runs fully in CI: upload + reconcile + manifest.json.
          # All values come from repo Settings → Secrets — no OSS defaults live in
          # code. Leave AK/SK unset to skip the OSS channel; once enabled,
          # bucket/region/prefix are required.
          BAILIAN_OSS_AK: ${{ secrets.BAILIAN_OSS_AK }}
          BAILIAN_OSS_SK: ${{ secrets.BAILIAN_OSS_SK }}
          BAILIAN_OSS_BUCKET: ${{ secrets.BAILIAN_OSS_BUCKET }}
          BAILIAN_OSS_REGION: ${{ secrets.BAILIAN_OSS_REGION }}
          BAILIAN_OSS_ENDPOINT: ${{ secrets.BAILIAN_OSS_ENDPOINT }}
          BAILIAN_RELEASE_PREFIX: ${{ secrets.BAILIAN_RELEASE_PREFIX }}
          BAILIAN_STATIC_PREFIX: ${{ secrets.BAILIAN_STATIC_PREFIX }}
        run: node tools/release/publish-stable.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }}

  publish-channel:
    if: inputs.mode == 'channel'
    name: publish channel (${{ inputs.package }}) to npm + binary
    runs-on: ubuntu-latest
    permissions:
      contents: write # create prerelease GitHub Release with binary assets
      id-token: write # OIDC for npm Trusted Publishing + provenance
    steps:
      - name: Require channel input
        if: ${{ inputs.channel == '' }}
        run: |
          echo "::error::mode=channel requires the workflow input \"channel\" (npm dist-tag, e.g. mcp / plugin / sync-release). Leave mode=stable if you do not need a dist-tag."
          exit 1

      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          cache: pnpm
          registry-url: "https://registry.npmjs.org/"

      - name: Install gitleaks
        run: |
          set -euo pipefail
          GITLEAKS_VERSION=8.21.2
          curl -sSfL \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            | sudo tar -xz -C /usr/local/bin gitleaks
          gitleaks version

      - name: Ensure zip (per-platform binary archives)
        run: sudo apt-get update && sudo apt-get install -y zip

      - run: pnpm install --frozen-lockfile

      # Binary compile uses `bun build --compile` CLI (not Bun.build API).
      # Keep this pin in sync with any local smoke tests of binary-compile.mjs.
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.2.19"

      - name: publish-channel
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # OSS release channel — same Settings-injected values as stable.
          BAILIAN_OSS_AK: ${{ secrets.BAILIAN_OSS_AK }}
          BAILIAN_OSS_SK: ${{ secrets.BAILIAN_OSS_SK }}
          BAILIAN_OSS_BUCKET: ${{ secrets.BAILIAN_OSS_BUCKET }}
          BAILIAN_OSS_REGION: ${{ secrets.BAILIAN_OSS_REGION }}
          BAILIAN_OSS_ENDPOINT: ${{ secrets.BAILIAN_OSS_ENDPOINT }}
          BAILIAN_RELEASE_PREFIX: ${{ secrets.BAILIAN_RELEASE_PREFIX }}
          BAILIAN_STATIC_PREFIX: ${{ secrets.BAILIAN_STATIC_PREFIX }}
        run: node tools/release/publish-channel.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }} --channel "${{ inputs.channel }}"