ci: GitHub flow, CI matrix, and semantic-release

.github/workflows/catalog-sync.yml

@@ -13,37 +13,28 @@ on:
 permissions:
   contents: write
   issues: write
+  pull-requests: write
 
 jobs:
   sync:
+    name: catalog-pr
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
-          token: ${{ secrets.CATALOG_PUSH_TOKEN || secrets.GITHUB_TOKEN }}
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-          registry-url: https://registry.npmjs.org
+          token: ${{ secrets.RELEASE_SYNC_TOKEN || secrets.CATALOG_PUSH_TOKEN || secrets.GITHUB_TOKEN }}
 
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: "1.3.14"
 
       - name: Install dependencies
-        run: bun install
-
-      - name: Unit tests
-        run: bun test tests/unit/
+        run: bun install --frozen-lockfile
 
-      - name: Sync catalog
+      - name: Open catalog PR
         env:
           CI: "true"
           FORCE: ${{ inputs.force }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # workit lesson: setup-node writes NODE_AUTH_TOKEN into .npmrc.
-          # NPM_TOKEN alone is an empty placeholder there.
-          NPM_TOKEN: ${{ secrets.NPMJS }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPMJS }}
+          GH_TOKEN: ${{ secrets.RELEASE_SYNC_TOKEN || secrets.CATALOG_PUSH_TOKEN || secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.RELEASE_SYNC_TOKEN || secrets.CATALOG_PUSH_TOKEN || secrets.GITHUB_TOKEN }}
         run: bun run scripts/catalog-sync-ci.ts

.github/workflows/ci.yml

@@ -0,0 +1,60 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  BUN_VERSION: "1.3.14"
+
+jobs:
+  test:
+    name: check (test)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Unit tests
+        run: bun test tests/unit/
+
+  typecheck:
+    name: check (typecheck)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Typecheck
+        run: bun run typecheck
+
+  pack:
+    name: check (pack)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "22"
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Verify release candidate
+        run: bun run verify:release-candidate

.github/workflows/release.yml

@@ -7,14 +7,19 @@ on:
 permissions:
   contents: write
   issues: write
+  pull-requests: write
 
 jobs:
   release:
+    name: semantic-release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "22"
           registry-url: https://registry.npmjs.org
@@ -24,16 +29,40 @@ jobs:
           bun-version: "1.3.14"
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
-      - name: Unit tests
-        run: bun test tests/unit/
+      - name: Verify release candidate
+        run: bun run verify:release-candidate
 
-      - name: Publish if unpublished
+      - name: Release
+        run: npx semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # workit lesson: setup-node writes NODE_AUTH_TOKEN into .npmrc.
-          # NPM_TOKEN alone is an empty placeholder there.
           NPM_TOKEN: ${{ secrets.NPMJS }}
           NODE_AUTH_TOKEN: ${{ secrets.NPMJS }}
-        run: bun run scripts/publish-if-needed.ts
+
+      - name: Sync release manifests to main
+        if: success()
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_SYNC_TOKEN || secrets.GITHUB_TOKEN }}
+        run: |
+          git checkout -- package.json manifest.json 2>/dev/null || true
+          bun run scripts/sync-release-manifests.ts
+          if [[ -z "$(git status --porcelain -- package.json manifest.json)" ]]; then
+            echo "manifests already match the latest tag"
+            exit 0
+          fi
+          VERSION=$(node -p "require('./package.json').version")
+          BRANCH="chore/manifest-sync-v${VERSION}"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git checkout -b "${BRANCH}"
+          git add package.json manifest.json
+          git commit -m "chore(release): sync manifests to v${VERSION}"
+          git push -u origin "${BRANCH}"
+          gh pr create \
+            --title "chore(release): sync manifests to v${VERSION}" \
+            --body "Automated post-release manifest alignment. Sets package.json and manifest.json to the released ${VERSION}." \
+            --base main --head "${BRANCH}"
+          gh pr merge --auto --squash --delete-branch || echo "auto-merge unavailable — merge the sync PR after CI is green"

CHANGELOG.md

@@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- CI catalog watch every 6 hours, `catalog-break` GitHub issues, and automatic npm patch + GitHub Release after publish.
+- GitHub flow: PR-gated `main`, CI matrix (`check (test|typecheck|pack)`), semantic-release on merge, catalog updates as PRs.
 - `manifest.json` describing the bundled catalog (status, cost sources, command-code version).
 - First publish of `@brainervirus/commandcode-go-opencode-provider`.
 - Last-good catalog cache and silent `startup.json` diagnostics under the plugin state dir.

README.md

@@ -1,20 +1,18 @@
 # @brainervirus/commandcode-go-opencode-provider
 
 [![npm version](https://img.shields.io/npm/v/@brainervirus/commandcode-go-opencode-provider)](https://www.npmjs.com/package/@brainervirus/commandcode-go-opencode-provider)
-[![CI](https://img.shields.io/github/actions/workflow/status/BrainerVirus/opencode-commandcode-provider/test.yml?branch=main&label=CI)](https://github.com/BrainerVirus/opencode-commandcode-provider/actions)
+[![CI](https://img.shields.io/github/actions/workflow/status/BrainerVirus/opencode-commandcode-provider/ci.yml?branch=main&label=CI)](https://github.com/BrainerVirus/opencode-commandcode-provider/actions)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
 [Command Code](https://commandcode.ai) API provider for [opencode](https://opencode.ai). Use Claude, GPT, Gemini, DeepSeek, Qwen, Kimi, GLM, MiniMax, Step, and other models through a single API key.
 
-This fork keeps a **bundled** model catalog current via CI. You do **not** need a local `command-code` CLI. Catalog patches publish automatically when Command Code ships a new npm version.
+This package keeps a **bundled** model catalog current via CI. You do **not** need a local `command-code` CLI. Catalog patches publish automatically after a green PR merges to `main`.
 
 ## Credits
 
-This plugin is based on **[opencode-commandcode-provider](https://github.com/brent-weatherall/opencode-commandcode-provider)** by **[Brent Weatherall](https://github.com/brent-weatherall)**. Thank you for the original OpenCode plugin, catalog extraction, and Command Code wiring.
+This plugin is based on **[opencode-commandcode-provider](https://github.com/brent-weatherall/opencode-commandcode-provider)** by **[Brent Weatherall](https://github.com/brent-weatherall)**. Thank you for the original OpenCode plugin, catalog extraction, and Command Code wiring. The license remains MIT; copyright stays with Brent Weatherall.
 
-This public fork started from [FanFan4204/opencode-commandcode-provider](https://github.com/FanFan4204/opencode-commandcode-provider) and continues that work with a CI-kept catalog and npm releases. The license remains MIT; copyright stays with Brent Weatherall.
-
-### Key improvements over upstream
+### What this package adds
 
 - Bundled `models.json` is the default runtime catalog (no local CLI scrape).
 - CLI cost extraction can fail (as on `command-code@1.38.x`) without dropping models.
@@ -83,9 +81,9 @@ bun test tests/unit/
 bun run sync -- --remote  # refresh models.json + manifest.json from command-code@latest
 ```
 
-CI (`.github/workflows/catalog-sync.yml`) runs that every 6 hours, commits catalog files to `main`, publishes an npm patch when `NPMJS` is set, and creates a GitHub Release **after** publish. Model extraction failures open a `catalog-break` issue and do not publish.
+CI (`.github/workflows/catalog-sync.yml`) opens a PR every 6 hours when Command Code ships a new catalog. Merge after **check (test)**, **check (typecheck)**, and **check (pack)** are green. `.github/workflows/release.yml` then runs **semantic-release** (npm publish + GitHub Release + tag). Do not push to `main`.
 
-The GitHub Actions secret name is `NPMJS` (same as workit). It is mapped to both `NPM_TOKEN` and `NODE_AUTH_TOKEN`. Use an npm **Automation** token (bypasses 2FA). A login token from `~/.npmrc` fails CI with `EOTP`.
+The GitHub Actions secret name is `NPMJS` (same as workit). It is mapped to both `NPM_TOKEN` and `NODE_AUTH_TOKEN`. Use an npm **Automation** token (bypasses 2FA). A login token from `~/.npmrc` fails CI with `EOTP`. Catalog PRs get a real CI run when `RELEASE_SYNC_TOKEN` (or `CATALOG_PUSH_TOKEN`) is a PAT; `GITHUB_TOKEN` can open the PR but GitHub will not start workflows from that event.
 
 ## License