pi-extensions/.github/workflows/codex.yml

name: "@eleith-pi/codex"

on:
  push:
    branches: [main]
    tags: ["@eleith-pi/codex@*"]
    paths:
      - extensions/codex/**
      - packages/internal/**
      - .github/workflows/codex.yml
      - package.json
      - pnpm-lock.yaml
      - pnpm-workspace.yaml
      - tsconfig.json
      - .oxlintrc.json
      - .oxfmtrc.json
      - .editorconfig
      - .gitignore
      - .changeset/config.json
  pull_request:
    branches: [main]
    paths:
      - extensions/codex/**
      - packages/internal/**
      - .github/workflows/codex.yml
      - package.json
      - pnpm-lock.yaml
      - pnpm-workspace.yaml
      - tsconfig.json
      - .oxlintrc.json
      - .oxfmtrc.json
      - .editorconfig
      - .gitignore
      - .changeset/config.json

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  check:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      PI_OFFLINE: "1"
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "26"
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Check formatting
        run: pnpm exec oxfmt --check extensions/codex packages/internal .github/workflows/codex.yml package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.json .oxlintrc.json .oxfmtrc.json .editorconfig .gitignore .changeset/config.json

      - name: Lint and typecheck
        run: |
          pnpm --filter @eleith-pi/codex --filter @eleith/pi-internal lint
          pnpm --filter @eleith-pi/codex --filter @eleith/pi-internal check

      - name: Test
        run: pnpm --filter @eleith-pi/codex --filter @eleith/pi-internal test

      - name: Build
        run: pnpm --filter @eleith-pi/codex build

  publish:
    needs: check
    if: github.ref_type == 'tag' && startsWith(github.ref_name, '@eleith-pi/codex@')
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "26"
          package-manager-cache: false
          registry-url: https://registry.npmjs.org/
          scope: "@eleith-pi"

      - name: Check release tag
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          set -eu
          PACKAGE_NAME=$(node -p "require('./extensions/codex/package.json').name")
          VERSION=$(node -p "require('./extensions/codex/package.json').version")
          if [ "$RELEASE_TAG" != "$PACKAGE_NAME@$VERSION" ]; then
            echo "Version mismatch: tag $RELEASE_TAG does not match $PACKAGE_NAME@$VERSION"
            exit 1
          fi
          if [ "$VERSION" = "0.0.0" ]; then
            echo "Refusing to publish placeholder version 0.0.0"
            exit 1
          fi

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm --filter @eleith-pi/codex build

      - name: Check npm version
        id: registry_version
        env:
          NPM_CONFIG_USERCONFIG: /dev/null
        run: |
          set -eu
          VERSION=$(node -p "require('./extensions/codex/package.json').version")
          mkdir -p .cache
          if npm view "@eleith-pi/codex@$VERSION" version --json --registry=https://registry.npmjs.org/ > .cache/codex-npm.json 2>/dev/null; then
            echo "@eleith-pi/codex@$VERSION is already published; skipping"
            echo "published=true" >> "$GITHUB_OUTPUT"
          else
            node -e 'const result = require("./.cache/codex-npm.json"); if (result.error?.code !== "E404") throw new Error("Registry lookup failed; refusing to publish");'
            echo "published=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish to npm
        if: steps.registry_version.outputs.published == 'false'
        run: pnpm --filter @eleith-pi/codex publish --registry=https://registry.npmjs.org/ --access public --no-git-checks