opencode-cursor/.github/workflows/ci.yml at main · stablekernel/opencode-cursor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
name: CI

# `schedule` and `workflow_dispatch` exist for the model-data-drift job only.
# Triggers are workflow-wide in Actions, so every job below carries an `if:`
# that scopes it to the events it is actually for.
on:
  push:
    branches: ["**"]
  pull_request:
  schedule:
    - cron: "0 9 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    name: typecheck · test · build (node ${{ matrix.node-version }})
    # Code CI only. The weekly cron and manual dispatch exist for
    # model-data-drift; re-running the matrix on them buys nothing.
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node-version: ["22.x", "24.x"]
    steps:
      - uses: actions/checkout@v7

      - name: Set up Node ${{ matrix.node-version }}
        uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm

      - name: Verify lockfile uses only the public npm registry
        run: |
          if grep -E '"resolved":[[:space:]]*"https?://' package-lock.json | grep -vq 'https://registry.npmjs.org/'; then
            echo "::error::package-lock.json contains non-npmjs resolved URLs:"
            grep -nE '"resolved":[[:space:]]*"https?://' package-lock.json | grep -v 'https://registry.npmjs.org/' || true
            exit 1
          fi

      - name: Install dependencies
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Test
        run: npm test

      - name: Build
        run: npm run build

  model-data-drift:
    name: model limits · drift vs Cursor docs
    # Deliberately not on pull_request: this job reaches cursor.com, and PR CI
    # stays hermetic.
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: "24.x"
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Check committed model limits against Cursor docs
        run: |
          log="$RUNNER_TEMP/drift.log"
          set +e
          npm run sync:model-limits -- --check 2>&1 | tee "$log"
          code=${PIPESTATUS[0]}
          set -e
          if [ "$code" = "1" ]; then
            echo "::error::src/model-limits.ts is stale. Run 'npm run sync:model-limits' and commit."
            exit 1
          fi
          if [ "$code" = "2" ]; then
            echo "::error::Could not verify model data (docs unreachable, unparseable, or a model id matched nothing). The drift check did not run — treat this as unverified, not as passing."
            exit 1
          fi
          if [ "$code" != "0" ]; then
            echo "::error::Unexpected exit code $code from the drift check."
            exit "$code"
          fi
          # Exit 0 is only trustworthy if the run also reported its summary. A
          # bare 0 is what "did nothing at all" looks like, and that has
          # happened: an entry-point guard once skipped main() entirely and the
          # job passed for free. Demand the evidence, not just the code.
          if ! grep -qE 'sync-model-limits: src/model-limits\.ts is up to date \(context: [0-9]+ from docs, [0-9]+ overridden \| cost: [0-9]+ from docs, [0-9]+ overridden \| [0-9]+ model ids\)' "$log"; then
            echo "::error::Drift check exited 0 without printing a run summary — it did not actually verify anything."
            exit 1
          fi

  integration:
    name: e2e · opencode loads plugin & lists models
    # Code CI only, same reason as `build`.
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: "24.x"
          cache: npm

      - name: Verify lockfile uses only the public npm registry
        run: |
          if grep -E '"resolved":[[:space:]]*"https?://' package-lock.json | grep -vq 'https://registry.npmjs.org/'; then
            echo "::error::package-lock.json contains non-npmjs resolved URLs:"
            grep -nE '"resolved":[[:space:]]*"https?://' package-lock.json | grep -v 'https://registry.npmjs.org/' || true
            exit 1
          fi

      - name: Install dependencies
        run: npm ci

      - name: Install opencode, load the plugin, and list Cursor models
        run: bash scripts/integration-test.sh
        env:
          # Optional: when set, the script additionally verifies live auth and
          # Cursor.models.list(). Without it, the fallback model path is tested.
          CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}