Add a publish path for @redrob-code/sdk, separate from the signing release - #53
Merged
Merged
Conversation
…e signing release The SDK has never been published. `publish.ts` was already written and complete; nothing called it, and `release.yml` mentions npm nowhere. So a consumer outside this repository cannot depend on the fork's own SDK at all -- which is why the desktop app still consumes the upstream `@opencode-ai/sdk` and cannot see types added here. A separate workflow rather than a step in `release.yml`, deliberately. That workflow reaches the Apple and Windows signing credentials, and bolting an npm publish onto it means a missing or expired token turns a signed binary release red AFTER the artifacts are already out. Here a token problem fails one run that has published nothing else. `workflow_dispatch` only, dry-run by default. The first publish of a public package under this scope is not reversible: npm allows unpublishing a new version only within 72 hours, and a name once taken stays taken. The version comes from the release, not from `package.json`, which holds `0.0.0` on purpose. This package is generated from the CLI's own API surface, so a version committed beside it would be a second number to bump and would drift from the CLI it describes. Taking it from the release tag also makes an SDK build answerable -- a consumer can tell which CLI generated it -- and `publish.ts` restores the file afterwards, so a release leaves no diff behind. The repository-id guard matches `release.yml`: a fork must never publish under this scope, and a rename must not silently switch the guard off.
This was referenced Sep 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The SDK has never been published.
packages/sdk/js/script/publish.tswas already written and complete — nothing called it, andrelease.ymlmentions npm nowhere. So nothing outside this repository can depend on the fork's own SDK, which is why the desktop app still consumes the upstream@opencode-ai/sdkand cannot see types added here.A separate workflow, deliberately
release.ymlreaches the Apple and Windows signing credentials. Bolting an npm publish onto it means a missing or expired token turns a signed binary release red after the artifacts are already out. Here a token problem fails one run that has published nothing else.workflow_dispatchonly, dry-run by default: the first publish of a public package under this scope is not reversible — npm allows unpublishing a new version only within 72 hours, and a name once taken stays taken.The version comes from the release
packages/sdk/js/package.jsonholds0.0.0on purpose. The package is generated from the CLI's own API surface, so a version committed beside it would be a second number to remember to bump and would drift from the CLI it describes.Taking it from the release tag also makes an SDK build answerable — a consumer can tell which CLI generated it — and
publish.tsrestores the file afterwards, so a release leaves no diff behind.What I could not verify
I cannot read organisation secrets (
403, needsadmin:org), and this repository has zero repo-level secrets (total_count: 0) whilerelease.ymluses org-level signing secrets successfully. So I cannot confirmNPM_TOKENresolves — the workflow has an explicit check that fails with one clear line if it does not, rather than lettingnpm publishfail after the pack.The repository-id guard matches
release.yml: a fork must never publish under this scope, and a rename must not silently switch the guard off.Gates
Version wiring verified locally:
REDROB_VERSION=0.4.1→Script.version0.4.1, channellatest.