cli-release.yml

name: CLI release
on:
  push:
    tags: ['v*']
  pull_request:
    paths:
      - '.github/workflows/cli-release.yml'
      - 'scripts/build.mjs'
      - 'scripts/*cli-release.mjs'
      - 'scripts/release-cli.mjs'
      - 'scripts/lib/cli-release.mjs'
      - 'scripts/verify.mjs'
      - 'test/smoke.test.mjs'
      - 'test/byok.test.mjs'
      - 'pnpm-lock.yaml'
      - 'package.json'
      - 'packages/tui/package.json'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Optional tag matching the source version (dry run; does not publish)'
        required: false
        type: string
permissions:
  contents: read
concurrency:
  group: cli-release-${{ inputs.tag || github.ref }}
  cancel-in-progress: false
jobs:
  build:
    runs-on: ubuntu-latest
    # The same ceiling the CI verify job has: this job runs the same
    # verification pipeline, including the real-browser suite.
    timeout-minutes: 40
    outputs:
      version: ${{ steps.release.outputs.version }}
      matrix: ${{ steps.release.outputs.matrix }}
      tag: ${{ steps.release.outputs.tag }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: pnpm
      - name: Validate release version and revision
        id: release
        shell: bash
        run: |
          node --input-type=module -e 'import { appendFileSync } from "node:fs"; import { cliBuildVersion, cliReleaseTargets } from "./scripts/lib/cli-release.mjs"; const tag = process.env.REQUESTED_TAG || `v${cliBuildVersion(process.cwd())}`; const version = cliBuildVersion(process.cwd(), tag); appendFileSync(process.env.GITHUB_OUTPUT, `version=${version}\ntag=${tag}\nmatrix=${JSON.stringify({include: cliReleaseTargets})}\n`); appendFileSync(process.env.GITHUB_ENV, `MCODE_RELEASE_TAG=${tag}\n`);'
          if [ "$EVENT_NAME" = push ]; then
            test "$(git rev-parse "refs/tags/$REQUESTED_TAG^{commit}")" = "$(git rev-parse HEAD)"
          fi
        env:
          EVENT_NAME: ${{ github.event_name }}
          REQUESTED_TAG: ${{ inputs.tag || (github.event_name == 'push' && github.ref_name) || '' }}
      - run: pnpm install --frozen-lockfile
      - uses: ./.github/actions/setup-gitleaks
      - name: Scan source history
        run: gitleaks git --redact --config .gitleaks.toml --log-opts=--all
      - run: pnpm verify
        env:
          MCODE_VERIFY_REPORT_DIR: ${{ runner.temp }}/build-report
      - name: Scan distribution
        run: gitleaks dir dist --redact --config .gitleaks.toml
      - name: Package the tagged CLI
        shell: bash
        run: node scripts/package-cli-release.mjs "$MCODE_RELEASE_TAG" "$RUNNER_TEMP/package"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: cli-package
          path: ${{ runner.temp }}/package/
          retention-days: 14
          if-no-files-found: error
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: ${{ always() }}
        with:
          name: cli-build-report
          path: ${{ runner.temp }}/build-report/
          retention-days: 14
  install:
    needs: build
    env:
      MCODE_RELEASE_TAG: ${{ needs.build.outputs.tag }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.build.outputs.matrix) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: cli-package
          path: ${{ runner.temp }}/package
      - run: pnpm verify --profile package
        env:
          MCODE_RELEASE_ARCHIVE: ${{ runner.temp }}/package/minimax-code-${{ needs.build.outputs.version }}.tar.gz
          MCODE_VERIFY_REPORT_DIR: ${{ runner.temp }}/install-report
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: ${{ always() }}
        with:
          name: cli-install-${{ matrix.os }}-${{ matrix.node }}
          path: ${{ runner.temp }}/install-report/
          retention-days: 14
  publish:
    needs: [build, install]
    if: github.event_name == 'push'
    permissions:
      contents: write
    runs-on: ubuntu-latest
    timeout-minutes: 5
    env:
      MCODE_RELEASE_TAG: ${{ needs.build.outputs.tag }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          package-manager-cache: false
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: cli-package
          path: ${{ runner.temp }}/package
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: cli-install-*
          path: ${{ runner.temp }}/reports
      - name: Publish only the authenticated, validated archive
        run: node scripts/publish-cli-release.mjs
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          MCODE_RELEASE_DIRECTORY: ${{ runner.temp }}/package
          MCODE_RELEASE_REPORTS: ${{ runner.temp }}/reports
  # Publishes the single-bin ACP launcher (@minimax-ai/code-acp) in lockstep
  # with @minimax-ai/code, which the ACP registry runs via `npx ... acp`.
  # Opt-in: set repo variable MCODE_ACP_PUBLISH=true and secret NPM_TOKEN.
  publish-acp:
    needs: [build, publish]
    if: github.event_name == 'push' && vars.MCODE_ACP_PUBLISH == 'true'
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      VERSION: ${{ needs.build.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'
          package-manager-cache: false
      - name: Wait for @minimax-ai/code at this version on npm
        shell: bash
        run: |
          for _ in $(seq 1 80); do
            npm view "@minimax-ai/code@$VERSION" version >/dev/null 2>&1 && exit 0
            sleep 20
          done
          echo "@minimax-ai/code@$VERSION not on npm after waiting" >&2; exit 1
      - name: Stamp and publish @minimax-ai/code-acp
        working-directory: packages/code-acp
        shell: bash
        run: |
          if npm view "@minimax-ai/code-acp@$VERSION" version >/dev/null 2>&1; then
            echo "already published"; exit 0
          fi
          npm pkg set version="$VERSION" "dependencies.@minimax-ai/code=$VERSION"
          tag=latest; [[ "$VERSION" == *-* ]] && tag=next
          npm publish --access public --provenance --tag "$tag"
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}