1111 - bailian-cli
1212 - knowledge-studio-cli
1313 - bailian-kb-dsh
14+ - bailian-memo-dsh
1415 mode :
1516 description : " Publish mode"
1617 required : true
1920 - channel
2021 - stable
2122 channel :
22- description : " Required when mode=channel. npm dist-tag only (lowercase, digits, dashes), e.g. mcp / plugin / sync-release. bailian-cli binary CDN always overwrites sync-release.json; knowledge-studio-cli and bailian-kb- dsh are npm-only."
23+ description : " Required when mode=channel. npm dist-tag only (lowercase, digits, dashes), e.g. mcp / plugin / sync-release. bailian-cli binary CDN always overwrites sync-release.json; knowledge-studio-cli and dsh plugins are npm-only."
2324 required : false
2425 type : string
2526
@@ -29,7 +30,7 @@ concurrency:
2930
3031jobs :
3132 publish-stable :
32- if : inputs.mode == 'stable' && inputs.package != 'bailian-kb-dsh'
33+ if : inputs.mode == 'stable' && inputs.package != 'bailian-kb-dsh' && inputs.package != 'bailian-memo-dsh'
3334 name : publish stable (${{ inputs.package }}) to npm + binary + tag
3435 runs-on : ubuntu-latest
3536 environment : production # Required Reviewers gate
@@ -59,13 +60,28 @@ jobs:
5960 - name : Ensure zip and tar (per-platform binary archives)
6061 run : sudo apt-get update && sudo apt-get install -y zip
6162
63+ # bun build --compile leaves an invalid darwin linker signature. rcodesign
64+ # re-signs those Mach-O files on the Linux runner (binary-codesign.mjs).
65+ - name : Install rcodesign (ad-hoc sign darwin binaries)
66+ run : |
67+ set -euo pipefail
68+ RCODESIGN_VERSION=0.29.0
69+ asset="apple-codesign-${RCODESIGN_VERSION}-x86_64-unknown-linux-musl.tar.gz"
70+ curl -fsSL -o "/tmp/${asset}" \
71+ "https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign/${RCODESIGN_VERSION}/${asset}"
72+ tar -xzf "/tmp/${asset}" -C /tmp
73+ sudo install -m 755 \
74+ "/tmp/apple-codesign-${RCODESIGN_VERSION}-x86_64-unknown-linux-musl/rcodesign" \
75+ /usr/local/bin/rcodesign
76+ rcodesign --version
77+
6278 - run : pnpm install --frozen-lockfile
6379
6480 # Binary compile uses `bun build --compile` CLI (not Bun.build API).
6581 # Keep this pin in sync with any local smoke tests of binary-compile.mjs.
6682 - uses : oven-sh/setup-bun@v2
6783 with :
68- bun-version : " 1.2.19 "
84+ bun-version : " 1.3.14 "
6985
7086 - name : publish-stable
7187 env :
@@ -79,10 +95,12 @@ jobs:
7995 # Bucket / prefix / allowlists live in the FC function.
8096 FC_TRIGGER_URL : ${{ vars.FC_TRIGGER_URL }}
8197 FC_RELEASE_AUDIENCE : ${{ vars.FC_RELEASE_AUDIENCE }}
98+ # Script order: git tag, then binary GitHub Release + OSS, then npm.
99+ # OSS upload can fail on a network blip; npm must not succeed first.
82100 run : node tools/release/publish-stable.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }}
83101
84102 publish-channel :
85- if : inputs.mode == 'channel' && inputs.package != 'bailian-kb-dsh'
103+ if : inputs.mode == 'channel' && inputs.package != 'bailian-kb-dsh' && inputs.package != 'bailian-memo-dsh'
86104 name : publish channel (${{ inputs.package }}) to npm + binary
87105 runs-on : ubuntu-latest
88106 permissions :
@@ -117,13 +135,28 @@ jobs:
117135 - name : Ensure zip and tar (per-platform binary archives)
118136 run : sudo apt-get update && sudo apt-get install -y zip
119137
138+ # bun build --compile leaves an invalid darwin linker signature. rcodesign
139+ # re-signs those Mach-O files on the Linux runner (binary-codesign.mjs).
140+ - name : Install rcodesign (ad-hoc sign darwin binaries)
141+ run : |
142+ set -euo pipefail
143+ RCODESIGN_VERSION=0.29.0
144+ asset="apple-codesign-${RCODESIGN_VERSION}-x86_64-unknown-linux-musl.tar.gz"
145+ curl -fsSL -o "/tmp/${asset}" \
146+ "https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign/${RCODESIGN_VERSION}/${asset}"
147+ tar -xzf "/tmp/${asset}" -C /tmp
148+ sudo install -m 755 \
149+ "/tmp/apple-codesign-${RCODESIGN_VERSION}-x86_64-unknown-linux-musl/rcodesign" \
150+ /usr/local/bin/rcodesign
151+ rcodesign --version
152+
120153 - run : pnpm install --frozen-lockfile
121154
122155 # Binary compile uses `bun build --compile` CLI (not Bun.build API).
123156 # Keep this pin in sync with any local smoke tests of binary-compile.mjs.
124157 - uses : oven-sh/setup-bun@v2
125158 with :
126- bun-version : " 1.2.19 "
159+ bun-version : " 1.3.14 "
127160
128161 - name : publish-channel
129162 env :
@@ -132,22 +165,21 @@ jobs:
132165 # credentials in this repo (see publish-stable env notes).
133166 FC_TRIGGER_URL : ${{ vars.FC_TRIGGER_URL }}
134167 FC_RELEASE_AUDIENCE : ${{ vars.FC_RELEASE_AUDIENCE }}
168+ # Script order: binary GitHub Release + OSS, then npm.
169+ # OSS upload can fail on a network blip; npm must not succeed first.
135170 run : node tools/release/publish-channel.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }} --channel "${{ inputs.channel }}"
136171
137- # bailian-kb-dsh is the dsh plugin (downstream host adapter): independent version,
138- # tsc + tsdown build, npm-only. It shares this workflow's entry UI and setup steps
139- # but NOT publish-stable.mjs / publish-channel.mjs — those broadcast one version
140- # across the locked bl package set and produce binary artifacts, neither of which
141- # applies here. See docs/agents/dsh-plugin.md.
142- publish-kb-dsh :
143- if : inputs.package == 'bailian-kb-dsh'
144- name : publish ${{ inputs.mode }} (bailian-kb-dsh) to npm
172+ # Independent dsh plugins (downstream host adapters): own version, tsc + tsdown,
173+ # npm-only. Shared workflow entry; NOT publish-stable/channel.mjs. See docs/agents/dsh-plugin.md.
174+ publish-dsh-plugin :
175+ if : inputs.package == 'bailian-kb-dsh' || inputs.package == 'bailian-memo-dsh'
176+ name : publish ${{ inputs.mode }} (${{ inputs.package }}) to npm
145177 runs-on : ubuntu-latest
146178 # stable goes through the Required Reviewers gate, same as the bl stable job;
147179 # channel stays ungated so dist-tag drops need no approval.
148180 environment : ${{ inputs.mode == 'stable' && 'production' || '' }}
149181 permissions :
150- contents : write # push the bailian-kb-dsh -v<version> tag (stable only)
182+ contents : write # push the <package> -v<version> tag (stable only)
151183 id-token : write # OIDC for npm Trusted Publishing + provenance
152184 steps :
153185 - name : Require channel input
@@ -177,5 +209,5 @@ jobs:
177209
178210 - run : pnpm install --frozen-lockfile
179211
180- - name : publish-kb- dsh
181- run : node tools/release/publish-kb- dsh.mjs ${{ inputs.mode == 'channel' && format('--channel "{0}"', inputs.channel) || '' }}
212+ - name : publish-dsh-plugin
213+ run : node tools/release/publish-dsh-plugin .mjs --package "${{ inputs.package }}" ${{ inputs.mode == 'channel' && format('--channel "{0}"', inputs.channel) || '' }}
0 commit comments