From 813b4e79adbf14465876e27b2befdf3e12efafea Mon Sep 17 00:00:00 2001
From: Test User <test@example.com>
Date: Sun, 30 Aug 2026 19:16:40 -0700
Subject: [PATCH] fix: unblock release publication workflows

---
 .github/workflows/publish.yml |  1 +
 .github/workflows/release.yml |  4 +++-
 package.json                  |  8 ++------
 src/release-workflows.test.ts | 14 ++++++++++++++
 4 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 460da53..e324c61 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -240,6 +240,7 @@ jobs:
     # an immutable npm version, so the exact packed artifact must pass prepublish-smoke first.
     needs: publish
     permissions:
+      actions: read
       contents: read
     uses: ./.github/workflows/opencode-smoke.yml
     with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 07e0182..5676985 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -65,8 +65,10 @@ jobs:
         if: needs.process.outputs.prs_created == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RELEASE_PR_NUMBER: ${{ fromJSON(needs.process.outputs.release_pr).number }}
+          RELEASE_PR_JSON: ${{ needs.process.outputs.release_pr }}
         run: |
+          RELEASE_PR_NUMBER=$(jq -er '.number | select(type == "number")' \
+            <<<"$RELEASE_PR_JSON")
           RELEASE_PR_SHA=$(gh api \
             "repos/${GITHUB_REPOSITORY}/pulls/${RELEASE_PR_NUMBER}" \
             --jq '.head.sha')
diff --git a/package.json b/package.json
index 726130f..844ec4c 100644
--- a/package.json
+++ b/package.json
@@ -22,9 +22,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": [
-    "dist"
-  ],
+  "files": ["dist"],
   "dependencies": {
     "@opencode-ai/plugin": "1.0.85"
   },
@@ -51,8 +49,6 @@
     "prepare": "husky"
   },
   "lint-staged": {
-    "*.{js,ts,json}": [
-      "biome check --write --no-errors-on-unmatched"
-    ]
+    "*.{js,ts,json}": ["biome check --write --no-errors-on-unmatched"]
   }
 }
diff --git a/src/release-workflows.test.ts b/src/release-workflows.test.ts
index 5e63b24..819e159 100644
--- a/src/release-workflows.test.ts
+++ b/src/release-workflows.test.ts
@@ -64,4 +64,18 @@ describe('release workflows', () => {
     expect(releaseWorkflow).toContain("outputs.prs_created == 'true'");
     expect(readProjectFile('.mise/tasks/setup')).toContain('bun install --frozen-lockfile');
   });
+
+  it('does not parse an absent release PR before the prerelease step condition is applied', () => {
+    expect(releaseWorkflow).not.toContain('fromJSON(needs.process.outputs.release_pr)');
+    expect(releaseWorkflow).toContain(
+      'RELEASE_PR_JSON: $' + '{{ needs.process.outputs.release_pr }}'
+    );
+    expect(releaseWorkflow).toContain('jq -er \'.number | select(type == "number")\'');
+  });
+
+  it('allows the post-publish smoke workflow to download the published artifact', () => {
+    expect(publishWorkflow).toMatch(
+      /postpublish-smoke:[\s\S]*?permissions:\n {6}actions: read\n {6}contents: read/
+    );
+  });
 });