From ad5f668f4b8e0dadef4e2e9e728360e1bff4df52 Mon Sep 17 00:00:00 2001 From: David Prokopec <41482710+davidprokopec@users.noreply.github.com> Date: Tue, 18 Aug 2026 23:26:16 +0200 Subject: [PATCH 1/2] chore: finish npm bootstrap (#4) --- .github/workflows/release-bootstrap.yml | 36 +++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/.github/workflows/release-bootstrap.yml b/.github/workflows/release-bootstrap.yml index d6c3138..d5eb7d7 100644 --- a/.github/workflows/release-bootstrap.yml +++ b/.github/workflows/release-bootstrap.yml @@ -14,11 +14,18 @@ name: Release (bootstrap, delete after first publish) on: workflow_dispatch: + inputs: + operation: + description: One-shot bootstrap operation + type: choice + options: [publish, remove-latest] + default: publish permissions: {} jobs: publish: + if: inputs.operation != 'remove-latest' runs-on: ubuntu-latest environment: npm permissions: @@ -62,6 +69,7 @@ jobs: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} tag: + if: inputs.operation != 'remove-latest' needs: publish runs-on: ubuntu-latest permissions: @@ -83,3 +91,31 @@ jobs: gh api "repos/$GITHUB_REPOSITORY/git/refs" \ -f "ref=refs/tags/v$version" -f "sha=$GITHUB_SHA" >/dev/null gh release create "v$version" --generate-notes --verify-tag + + remove-latest: + if: inputs.operation == 'remove-latest' + runs-on: ubuntu-latest + environment: npm + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Setup Node + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: "24" + registry-url: "https://registry.npmjs.org" + + - name: Pin npm + run: npm install -g npm@11.5.1 + + - name: Remove automatic latest tag + run: | + package="$(node -p "require('./package.json').name")" + npm dist-tag rm "$package" latest + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} From 7db5fb0e25eb8185005578291648865f850bef22 Mon Sep 17 00:00:00 2001 From: David Prokopec <41482710+davidprokopec@users.noreply.github.com> Date: Tue, 18 Aug 2026 23:30:09 +0200 Subject: [PATCH 2/2] chore: remove bootstrap workflow (#5) --- .github/workflows/release-bootstrap.yml | 121 ------------------------ README.md | 4 + 2 files changed, 4 insertions(+), 121 deletions(-) delete mode 100644 .github/workflows/release-bootstrap.yml diff --git a/.github/workflows/release-bootstrap.yml b/.github/workflows/release-bootstrap.yml deleted file mode 100644 index d5eb7d7..0000000 --- a/.github/workflows/release-bootstrap.yml +++ /dev/null @@ -1,121 +0,0 @@ -# ONE SHOT. Delete this file after the first successful publish. -# -# npm trusted publishing cannot be configured for a package that does not yet -# exist on the registry, so the very first publish cannot use OIDC. This -# workflow does that one publish with a short lived granular token, still -# producing a provenance attestation, so no released version is unsigned. -# -# Afterwards: configure the Trusted Publisher on npmjs.com, delete the -# NPM_TOKEN secret, revoke the token, and delete this file. release.yml then -# handles every release with no stored credential at all. -# -# Manual dispatch only — it cannot fire on a tag by accident. -name: Release (bootstrap, delete after first publish) - -on: - workflow_dispatch: - inputs: - operation: - description: One-shot bootstrap operation - type: choice - options: [publish, remove-latest] - default: publish - -permissions: {} - -jobs: - publish: - if: inputs.operation != 'remove-latest' - runs-on: ubuntu-latest - environment: npm - permissions: - contents: read - id-token: write # signs the provenance attestation - - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - - name: Setup Bun - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - with: - bun-version: "1.3.14" - - - name: Install - run: bun install --frozen-lockfile --ignore-scripts - - - name: Verify - run: | - bun run typecheck - bun run lint - bun test - - - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version: "24" - registry-url: "https://registry.npmjs.org" - - - name: Pin npm - run: npm install -g npm@11.5.1 - - # --provenance is explicit here because token based publishing does not - # imply it, unlike trusted publishing. - - name: Publish - run: npm publish --tag beta --provenance - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - - tag: - if: inputs.operation != 'remove-latest' - needs: publish - runs-on: ubuntu-latest - permissions: - contents: write - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - # Tags the published commit so the repository matches the registry. A tag - # pushed with the job token does not trigger release.yml, so this cannot - # cause a second publish. - - name: Tag and release - env: - GH_TOKEN: ${{ github.token }} - run: | - version="$(node -p "require('./package.json').version")" - gh api "repos/$GITHUB_REPOSITORY/git/refs" \ - -f "ref=refs/tags/v$version" -f "sha=$GITHUB_SHA" >/dev/null - gh release create "v$version" --generate-notes --verify-tag - - remove-latest: - if: inputs.operation == 'remove-latest' - runs-on: ubuntu-latest - environment: npm - permissions: - contents: read - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version: "24" - registry-url: "https://registry.npmjs.org" - - - name: Pin npm - run: npm install -g npm@11.5.1 - - - name: Remove automatic latest tag - run: | - package="$(node -p "require('./package.json').name")" - npm dist-tag rm "$package" latest - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} diff --git a/README.md b/README.md index c4754a7..8cf69ca 100644 --- a/README.md +++ b/README.md @@ -69,6 +69,10 @@ The V2 plugin API is beta. This release is built and verified against If your OpenCode is on a different beta build, check for a matching release of this plugin. +Always install with the explicit `@beta` tag. npm assigned `latest` during the +one-time package bootstrap, but the release workflow never publishes or moves +that tag while OpenCode V2 remains beta. + ## Commands | Command | Effect |