chore: switch to semantic-release with OIDC trusted publishing

.github/workflows/release.yml

@@ -23,10 +23,6 @@ on:
       - 'examples/**'
       - 'packages/docs/**'
 
-permissions:
-  contents: write
-  packages: write
-
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -55,7 +51,6 @@ jobs:
 
       - name: Install platform-specific dependencies
         run: |
-          # Install platform dependencies for Linux (temporary, not saved to package.json)
           pnpm add @oxlint/linux-x64-gnu --save-dev || echo "Failed to install oxlint platform dependency, continuing..."
 
       - name: Check formatting
@@ -78,6 +73,12 @@ jobs:
   release:
     needs: test
     runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      id-token: write
     steps:
       - name: Generate GitHub App Token
         id: generate_token
@@ -112,62 +113,14 @@ jobs:
 
       - name: Install platform-specific dependencies
         run: |
-          # Install platform dependencies for Linux CI environment (temporary, not saved to package.json)
           pnpm add @oxlint/linux-x64-gnu --save-dev || echo "Failed to install oxlint platform dependency"
 
       - name: Build project
-        run: pnpm run build
-
-      - name: Bump version and create tag
-        id: version
-        uses: mathieudutour/github-tag-action@v6.2
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          default_bump: patch
-          tag_prefix: v
-
-      - name: Update package.json version
-        if: steps.version.outputs.new_tag
         run: |
-          NEW_VERSION=${{ steps.version.outputs.new_version }}
-
-          # Update root package.json
-          pnpm version $NEW_VERSION --no-git-tag-version
-
-          # Update all workspace package versions
-          pnpm -r exec pnpm version $NEW_VERSION --no-git-tag-version
-
-          # Ensure no platform-specific dependencies were accidentally saved
-          pnpm remove @rollup/rollup-linux-x64-gnu @oxlint/linux-x64-gnu 2>/dev/null || true
+          pnpm add @rollup/rollup-linux-x64-gnu --save-dev || echo "Failed to install Rollup platform dependency"
+          pnpm run build
 
-          git config --local user.email "action@github.com"
-          git config --local user.name "GitHub Action"
-          git add package.json packages/*/package.json pnpm-lock.yaml
-          git commit -m "chore: bump version to $NEW_VERSION [skip ci]" || exit 0
-          git push
+      - name: Release
+        run: pnpm exec semantic-release
         env:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
-
-      - name: Create GitHub Release
-        if: steps.version.outputs.new_tag
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ steps.version.outputs.new_tag }}
-          name: Release ${{ steps.version.outputs.new_tag }}
-          body: ${{ steps.version.outputs.changelog }}
-          draft: false
-          prerelease: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Publish to npm
-        if: steps.version.outputs.new_tag
-        run: |
-          # Publish only public packages (those without "private": true)
-          # Using pnpm publish with --filter to exclude private packages
-          pnpm --filter '@codemcp/workflows-server' publish --access public --no-git-checks
-          pnpm --filter '@codemcp/workflows' publish --access public --no-git-checks
-          pnpm --filter '@codemcp/workflows-opencode' publish --access public --no-git-checks
-          pnpm --filter '@codemcp/workflows-opencode-tui' publish --access public --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.releaserc.json

@@ -0,0 +1,56 @@
+{
+  "branches": ["main"],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    ["@semantic-release/changelog", { "changelogFile": "CHANGELOG.md" }],
+    [
+      "@semantic-release/exec",
+      {
+        "prepareCmd": "node -e \"const fs=require('fs');const v='${nextRelease.version}';['package.json','packages/mcp-server/package.json','packages/opencode-plugin/package.json','packages/opencode-tui-plugin/package.json'].forEach(f=>{const p=JSON.parse(fs.readFileSync(f,'utf8'));p.version=v;fs.writeFileSync(f,JSON.stringify(p,null,2)+'\\n');})\""
+      }
+    ],
+    [
+      "@semantic-release/npm",
+      {
+        "pkgRoot": ".",
+        "npmPublish": true
+      }
+    ],
+    [
+      "@semantic-release/npm",
+      {
+        "pkgRoot": "packages/mcp-server",
+        "npmPublish": true
+      }
+    ],
+    [
+      "@semantic-release/npm",
+      {
+        "pkgRoot": "packages/opencode-plugin",
+        "npmPublish": true
+      }
+    ],
+    [
+      "@semantic-release/npm",
+      {
+        "pkgRoot": "packages/opencode-tui-plugin",
+        "npmPublish": true
+      }
+    ],
+    [
+      "@semantic-release/git",
+      {
+        "assets": [
+          "CHANGELOG.md",
+          "package.json",
+          "packages/mcp-server/package.json",
+          "packages/opencode-plugin/package.json",
+          "packages/opencode-tui-plugin/package.json"
+        ],
+        "message": "chore: release ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+      }
+    ],
+    ["@semantic-release/github", { "failComment": false, "failTitle": false }]
+  ]
+}

package.json

@@ -8,7 +8,8 @@
     "ade-workflows": "packages/cli/dist/index.js"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "engines": {
     "node": ">=20.0.0",
@@ -59,6 +60,12 @@
   "devDependencies": {
     "@codemcp/workflows-core": "workspace:*",
     "@modelcontextprotocol/inspector": "0.19.0",
+    "@semantic-release/changelog": "7.0.0",
+    "@semantic-release/exec": "7.1.0",
+    "@semantic-release/git": "10.0.1",
+    "@semantic-release/github": "12.0.9",
+    "@semantic-release/npm": "13.1.5",
+    "semantic-release": "25.0.9",
     "@oxlint/linux-x64-gnu": "^1.43.0",
     "@tsconfig/node24": "24.0.4",
     "@tsconfig/strictest": "2.0.8",

packages/mcp-server/package.json

@@ -8,7 +8,8 @@
     "ade-workflows-server": "dist/index.js"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "files": [
     "dist/**/*",

packages/opencode-plugin/package.json

@@ -10,7 +10,8 @@
     "resources/**/*"
   ],
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "scripts": {
     "build": "tsup && pnpm copy-resources",

packages/opencode-tui-plugin/package.json

@@ -12,6 +12,10 @@
   "publishConfig": {
     "access": "public"
   },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "scripts": {
     "typecheck": "tsc --noEmit",
     "lint": "oxlint .",