build-opencode.yml

name: Build OpenCode CLI
# 显式设置 run-name 为 commit 消息；GitHub Actions 默认 display_title 不再自动回退到 commit 消息
run-name: ${{ github.event.head_commit.message || github.workflow }}

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Override version, for example 1.15.6-smark. Empty means packages/opencode/package.json version."
        required: false
        type: string
  push:
    branches:
      - dev-smark
    paths:
      - ".github/workflows/build-opencode.yml"
      - ".github/actions/setup-bun/action.yml"
      - "packages/opencode/**"
      - "packages/core/**"
      - "packages/plugin/**"
      - "packages/script/**"
      - "packages/sdk/js/**"
      - "packages/ui/**"
      - "package.json"
      - "bun.lock"
      - "install"

permissions:
  contents: write

concurrency:
  group: build-opencode-${{ github.ref }}-${{ github.event.inputs.version || 'package-json' }}
  cancel-in-progress: false

jobs:
  version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.pkg.outputs.version }}
      tag: ${{ steps.pkg.outputs.tag }}
    steps:
      - uses: actions/checkout@v4

      - id: pkg
        shell: bash
        run: |
          set -euo pipefail

          VERSION="${{ github.event.inputs.version || '' }}"
          if [ -z "$VERSION" ]; then
            VERSION="$(node -p "require('./packages/opencode/package.json').version")"
          fi

          VERSION="${VERSION#v}"

          if [ -z "$VERSION" ] || [ "$VERSION" = "undefined" ]; then
            echo "Failed to resolve packages/opencode/package.json version" >&2
            exit 1
          fi

          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
          echo "Resolved version: $VERSION"
          echo "Resolved tag: v$VERSION"

  build-macos:
    needs: version
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4

      - uses: ./.github/actions/setup-bun

      - name: Build macOS binaries
        shell: bash
        run: |
          set -euo pipefail
          cd packages/opencode
          bun run script/build.ts \
            --version=${{ needs.version.outputs.version }} \
            --os=darwin \
            --skip-embed-web-ui

      - name: Sign and package macOS assets
        shell: bash
        run: |
          set -euo pipefail

          DIST="packages/opencode/dist"
          ASSETS="release-assets"
          mkdir -p "$ASSETS"

          package_macos_target() {
            local target="$1"
            local bin="${DIST}/${target}/bin/opencode"
            local out="${ASSETS}/${target}.zip"

            if [ ! -f "$bin" ]; then
              echo "Missing macOS binary: $bin" >&2
              exit 1
            fi

            chmod +x "$bin"

            # Ad-hoc signing prevents stale/broken signatures on downloaded CLI binaries.
            codesign --force --sign - --timestamp=none "$bin"
            codesign --verify --verbose=4 "$bin"

            rm -f "$out"
            (
              cd "${DIST}/${target}/bin"
              zip -9 -q "${GITHUB_WORKSPACE}/${out}" opencode
            )

            echo "Created $out"
          }

          package_macos_target opencode-darwin-arm64
          package_macos_target opencode-darwin-x64

          ls -lah "$ASSETS"

      - name: Upload macOS workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-assets-macos
          if-no-files-found: error
          retention-days: 7
          path: |
            release-assets/opencode-darwin-arm64.zip
            release-assets/opencode-darwin-x64.zip

  build-linux:
    needs: version
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: ./.github/actions/setup-bun

      - name: Install Linux packaging tools
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends dpkg-dev

      - name: Build Linux binaries
        shell: bash
        run: |
          set -euo pipefail
          cd packages/opencode
          bun run script/build.ts \
            --version=${{ needs.version.outputs.version }} \
            --os=linux \
            --skip-embed-web-ui

      - name: Package Linux assets
        shell: bash
        run: |
          set -euo pipefail

          VERSION="${{ needs.version.outputs.version }}"
          DIST="packages/opencode/dist"
          ASSETS="release-assets"
          mkdir -p "$ASSETS"

          package_linux_tarball() {
            local target="$1"
            local bin="${DIST}/${target}/bin/opencode"
            local out="${ASSETS}/${target}.tar.gz"

            if [ ! -f "$bin" ]; then
              echo "Skip missing Linux binary: $bin"
              return 0
            fi

            chmod +x "$bin"
            (
              cd "${DIST}/${target}/bin"
              tar -czf "${GITHUB_WORKSPACE}/${out}" opencode
            )

            echo "Created $out"
          }

          package_linux_tarball opencode-linux-x64
          package_linux_tarball opencode-linux-arm64

          if [ ! -f "${ASSETS}/opencode-linux-x64.tar.gz" ]; then
            echo "Required Linux x64 asset was not created" >&2
            exit 1
          fi

          # Debian/Ubuntu package for amd64. This intentionally uses /usr/local/bin
          # to match the current manual binary install convention for this fork.
          DEB_ROOT="/tmp/opencode-deb"
          PKG_DIR="${DEB_ROOT}/opencode_${VERSION}_amd64"
          BINARY="${DIST}/opencode-linux-x64/bin/opencode"
          DEB_OUT="${ASSETS}/opencode_${VERSION}_amd64.deb"

          rm -rf "$DEB_ROOT"
          mkdir -p "${PKG_DIR}/DEBIAN"
          mkdir -p "${PKG_DIR}/usr/local/bin"

          install -m 0755 "$BINARY" "${PKG_DIR}/usr/local/bin/opencode"

          cat > "${PKG_DIR}/DEBIAN/control" <<EOF
          Package: opencode
          Version: ${VERSION}
          Section: utils
          Priority: optional
          Architecture: amd64
          Maintainer: smark <smark@local>
          Description: opencode AI-powered development tool (smark build)
           A standalone AI coding assistant with TUI, version ${VERSION}.
          EOF

          # dpkg control files must not contain leading indentation.
          sed -i 's/^          //' "${PKG_DIR}/DEBIAN/control"

          dpkg-deb --build "$PKG_DIR" "$DEB_OUT"

          ls -lah "$ASSETS"

      - name: Upload Linux workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-assets-linux
          if-no-files-found: error
          retention-days: 7
          path: |
            release-assets/opencode-linux-x64.tar.gz
            release-assets/opencode-linux-arm64.tar.gz
            release-assets/opencode_*_amd64.deb

  build-windows:
    needs: version
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "22"

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - uses: microsoft/setup-msbuild@v2

      # Keep macOS/Linux on the shared setup-bun action, but avoid it on Windows:
      # restoring/saving the multi-GB Bun package cache is slower than a clean install
      # on GitHub-hosted Windows runners.
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json

      - name: Install Windows dependencies
        shell: pwsh
        env:
          ELECTRON_SKIP_BINARY_DOWNLOAD: "1"
          ELECTRON_SKIP_DOWNLOAD: "1"
          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
          PUPPETEER_SKIP_DOWNLOAD: "1"
          CYPRESS_INSTALL_BINARY: "0"
          HUSKY: "0"
        run: |
          $ErrorActionPreference = "Stop"

          python -c "import setuptools" 2>$null
          if ($LASTEXITCODE -ne 0) {
            python -m pip install setuptools
          }

          bun install --linker hoisted

      - name: Build Windows x64 binary
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          cd packages/opencode
          bun run script/build.ts --version=${{ needs.version.outputs.version }} --os=win32 --arch=x64 --skip-embed-web-ui

      - name: Package Windows assets
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"

          $Dist = "packages/opencode/dist"
          $Source = Join-Path $Dist "opencode-windows-x64/bin/opencode.exe"
          $Assets = "release-assets"
          $Stage = Join-Path $env:RUNNER_TEMP "opencode-windows-x64"
          $ZipOut = Join-Path $Assets "opencode-windows-x64.zip"
          $ExeOut = Join-Path $Assets "opencode-windows-x64.exe"

          if (!(Test-Path $Source)) {
            throw "Missing Windows binary: $Source"
          }

          New-Item -ItemType Directory -Force -Path $Assets | Out-Null
          New-Item -ItemType Directory -Force -Path $Stage | Out-Null

          Copy-Item $Source (Join-Path $Stage "opencode.exe") -Force
          Copy-Item $Source $ExeOut -Force

          if (Test-Path $ZipOut) {
            Remove-Item $ZipOut -Force
          }

          Compress-Archive -Path (Join-Path $Stage "opencode.exe") -DestinationPath $ZipOut -CompressionLevel Optimal

          Get-ChildItem $Assets | Format-Table Name, Length

      - name: Upload Windows workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-assets-windows
          if-no-files-found: error
          retention-days: 7
          path: |
            release-assets/opencode-windows-x64.zip
            release-assets/opencode-windows-x64.exe

  smoke-macos:
    # smoke必须下载刚刚打包的archive，而不是直接运行build目录，才能覆盖release层解压和权限行为。
    needs:
      - version
      - build-macos
    runs-on: macos-latest
    strategy:
      fail-fast: false
      matrix:
        target:
          # arm64和x64分别保留target identity；不能把arm runner的结果冒充Intel runtime。
          - opencode-darwin-arm64
          - opencode-darwin-x64
    steps:
      - uses: actions/checkout@v4

      - uses: ./.github/actions/setup-bun

      - name: Download macOS archive
        uses: actions/download-artifact@v4
        with:
          name: release-assets-macos
          path: release-assets

      - name: Extract and smoke compiled artifact
        shell: bash
        run: |
          # 每个matrix项使用独立runner temp，避免两个architecture覆盖同名opencode文件。
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/opentui-smoke"
          unzip -q "release-assets/${{ matrix.target }}.zip" -d "$RUNNER_TEMP/opentui-smoke"
          bun run --cwd packages/opencode script/smoke-opentui-artifact.ts \
            --binary "$RUNNER_TEMP/opentui-smoke/opencode"

  smoke-linux-x64:
    # Linux x64在现有host执行，证明glibc archive能加载对应OpenTUI native闭包。
    needs:
      - version
      - build-linux
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: ./.github/actions/setup-bun

      - name: Download Linux archives
        uses: actions/download-artifact@v4
        with:
          name: release-assets-linux
          path: release-assets

      - name: Extract and smoke compiled artifact
        shell: bash
        run: |
          # tarball内只允许最终opencode入口，harness的source依赖来自当前checkout而非archive旁路。
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/opentui-smoke"
          tar -xzf release-assets/opencode-linux-x64.tar.gz -C "$RUNNER_TEMP/opentui-smoke"
          bun run --cwd packages/opencode script/smoke-opentui-artifact.ts \
            --binary "$RUNNER_TEMP/opentui-smoke/opencode"

  smoke-linux-arm64:
    # arm runner是真实执行而非cross-compile；缺少runner或smoke失败都必须阻断checksums。
    needs:
      - version
      - build-linux
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v4

      - uses: ./.github/actions/setup-bun

      - name: Download Linux archives
        uses: actions/download-artifact@v4
        with:
          name: release-assets-linux
          path: release-assets

      - name: Extract and smoke compiled artifact
        shell: bash
        run: |
          # aarch64 archive在原生arm host执行，不能使用qemu或metadata检查替代native加载。
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/opentui-smoke"
          tar -xzf release-assets/opencode-linux-arm64.tar.gz -C "$RUNNER_TEMP/opentui-smoke"
          bun run --cwd packages/opencode script/smoke-opentui-artifact.ts \
            --binary "$RUNNER_TEMP/opentui-smoke/opencode"

  smoke-windows:
    # Windows使用ConPTY入口，不能用macOS PTY结果替代DLL加载和控制台退出证据。
    needs:
      - version
      - build-windows
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json

      - name: Install dependencies
        shell: pwsh
        env:
          ELECTRON_SKIP_BINARY_DOWNLOAD: "1"
          ELECTRON_SKIP_DOWNLOAD: "1"
          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
          PUPPETEER_SKIP_DOWNLOAD: "1"
          CYPRESS_INSTALL_BINARY: "0"
          HUSKY: "0"
        run: bun install --linker hoisted

      - name: Download Windows archive
        uses: actions/download-artifact@v4
        with:
          name: release-assets-windows
          path: release-assets

      - name: Extract and smoke compiled artifact
        shell: pwsh
        run: |
          # Expand-Archive后直接运行解压exe，确保zip中的最终文件而非构建目录接受ConPTY验证。
          $ErrorActionPreference = "Stop"
          $SmokeRoot = Join-Path $env:RUNNER_TEMP "opentui-smoke"
          New-Item -ItemType Directory -Force -Path $SmokeRoot | Out-Null
          Expand-Archive -Path "release-assets/opencode-windows-x64.zip" -DestinationPath $SmokeRoot -Force
          bun run --cwd packages/opencode script/smoke-opentui-artifact.ts --binary (Join-Path $SmokeRoot "opencode.exe")

  checksums:
    # checksums和release只能在closure及所有host smoke成功后生成，避免发布半验证产物。
    needs:
      - version
      - build-macos
      - build-linux
      - build-windows
      - opentui-closure
      - smoke-macos
      - smoke-linux-x64
      - smoke-linux-arm64
      - smoke-windows
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # release notes 需要完整 commit 历史 + 全部 tag

      - name: Download release workflow artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: release-assets-*
          path: release-assets
          merge-multiple: true

      - name: Add install script and generate checksums
        shell: bash
        run: |
          set -euo pipefail

          if [ ! -f install ]; then
            echo "Missing repository install script at ./install" >&2
            exit 1
          fi

          cp install release-assets/install
          chmod +x release-assets/install

          cd release-assets

          echo "Release assets before checksums:"
          find . -maxdepth 1 -type f -printf '%f\n' | sort

          find . -maxdepth 1 -type f ! -name checksums.txt -printf '%f\0' \
            | sort -z \
            | xargs -0 sha256sum > checksums.txt

          echo "==== checksums.txt ===="
          cat checksums.txt

      - name: Generate release notes from commit log
        env:
          VERSION: ${{ needs.version.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail

          # 上一个版本 tag（排除当前版本自身；匹配 v*-smark 格式）
          PREV_TAG=$(git tag --sort=-creatordate \
            | grep -E "^v[0-9]+\.[0-9]+\.[0-9]+(-smark)?$" \
            | grep -vE "^v${VERSION}$" \
            | head -1)

          {
            echo "## 更新内容"
            echo ""

            if [ -z "$PREV_TAG" ]; then
              echo "（首次发布）"
              git log --format="%h %s" --reverse | head -50
            else
              # 版本 bump commit：首个把当前版本号写进 package.json 的提交
              BUMPCOMMIT=$(git log "${PREV_TAG}..HEAD" --reverse --format="%H" \
                -S "\"version\": \"${VERSION}\"" -- packages/opencode/package.json | head -1)

              if [ -n "$BUMPCOMMIT" ]; then
                # 有版本 bump：分两节，避免上个版本期间积累的 commit 与本版本新增混在一起
                POST_BUMP=$(git log "${BUMPCOMMIT}..HEAD" --format="%h %s" --reverse)
                if [ -n "$POST_BUMP" ]; then
                  echo "### v${VERSION} 新增"
                  echo ""
                  echo "$POST_BUMP"
                  echo ""
                fi

                ACCUMULATED=$(git log "${PREV_TAG}..${BUMPCOMMIT}" --format="%h %s" --reverse)
                if [ -n "$ACCUMULATED" ]; then
                  echo "### 自 \`${PREV_TAG}\` 积累"
                  echo ""
                  echo "$ACCUMULATED"
                  echo ""
                fi
              else
                # 无版本 bump（同版本重新 push 或手动覆盖版本号）：单节展示全部增量
                echo "自 \`${PREV_TAG}\` 以来的变更："
                echo ""
                git log "${PREV_TAG}..HEAD" --format="%h %s" --reverse
                echo ""
              fi
            fi

            echo "---"
            echo "自动构建 from ${{ github.sha }}"
          } > release-notes.md

          echo "==== release-notes.md ===="
          cat release-notes.md

      - name: Create or update GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.version.outputs.tag }}
        shell: bash
        run: |
          set -euo pipefail

          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "Release $TAG already exists; updating notes and assets."
            gh release edit "$TAG" --repo "$GITHUB_REPOSITORY" --notes-file release-notes.md
          else
            gh release create "$TAG" \
              --repo "$GITHUB_REPOSITORY" \
              --target "$GITHUB_SHA" \
              --title "$TAG" \
              --notes-file release-notes.md
          fi

      - name: Upload release assets with retry
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.version.outputs.tag }}
        shell: bash
        run: |
          set -euo pipefail

          upload_with_retry() {
            local file="$1"
            local max_attempts=5
            local attempt=1

            while true; do
              echo "Uploading ${file} attempt ${attempt}/${max_attempts}"

              if gh release upload "$TAG" "$file" \
                --repo "$GITHUB_REPOSITORY" \
                --clobber; then
                echo "Uploaded ${file}"
                return 0
              fi

              if [ "$attempt" -ge "$max_attempts" ]; then
                echo "Failed to upload ${file} after ${max_attempts} attempts" >&2
                return 1
              fi

              sleep $(( attempt * 15 ))
              attempt=$(( attempt + 1 ))
            done
          }

          cd release-assets

          mapfile -t files < <(find . -maxdepth 1 -type f -printf '%f\n' | sort)
          if [ "${#files[@]}" -eq 0 ]; then
            echo "No release assets found" >&2
            exit 1
          fi

          echo "Uploading release assets:"
          printf '  %s\n' "${files[@]}"

          for file in "${files[@]}"; do
            upload_with_retry "$file"
          done

  opentui-closure:
    needs: version
    runs-on: ubuntu-latest
    timeout-minutes: 30
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout repository with OpenTUI provenance
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Setup Bun
        uses: ./.github/actions/setup-bun

      - name: Verify immutable OpenTUI closure
        working-directory: packages/opencode
        run: bun run script/verify-opentui-closure.ts --source-revision-authorized