Merge pull request #25 from modelstudioai/chore/publish-workflow

Chore/publish workflow

.github/workflows/ci.yml

@@ -14,11 +14,11 @@ jobs:
     name: lint + typecheck + test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "22"
           cache: pnpm

.github/workflows/publish.yml

@@ -1,27 +1,22 @@
-name: Release
-
-# Consolidated workflow because npm Trusted Publishers only allows ONE
-# (repo, workflow, environment) tuple per package — so stable + channel
-# must share a single workflow file.
+name: Publish
 
 on:
   workflow_dispatch:
     inputs:
       mode:
-        description: "Release mode"
+        description: "Publish mode"
         required: true
         type: choice
         options:
-          - stable
           - channel
+          - stable
       channel:
-        description: "dist-tag for channel mode (kebab-case, e.g. mcp/plugin/advisor). Reserved: latest/beta/alpha/next/rc/canary/dev. Ignored when mode=stable."
+        description: "dist-tag (channel mode only, e.g. mcp/plugin/advisor)"
         required: false
         type: string
 
-# Serialize stable globally; serialize channel per dist-tag name.
 concurrency:
-  group: release-${{ inputs.mode }}-${{ inputs.channel }}
+  group: publish-${{ inputs.mode }}-${{ inputs.channel }}
   cancel-in-progress: false
 
 jobs:
@@ -34,13 +29,13 @@ jobs:
       contents: write # push lightweight tag to origin
       id-token: write # OIDC for npm Trusted Publishing + provenance
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: "22"
+          node-version: "24"
           cache: pnpm
           registry-url: "https://registry.npmjs.org/"
 
@@ -66,13 +61,13 @@ jobs:
       contents: read # no tag, no Release; just publish
       id-token: write # OIDC for npm Trusted Publishing + provenance
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: "22"
+          node-version: "24"
           cache: pnpm
           registry-url: "https://registry.npmjs.org/"
 

packages/cli/README.md

@@ -79,7 +79,10 @@ npx skills add modelstudioai/skills --all -g
 ## Quick Start
 
 ```bash
-# Authenticate
+# Authenticate, recommended
+bl auth login --console
+
+# Or authenticate with an API key
 bl auth login --api-key sk-xxxxx
 
 # Chat with Qwen

tools/release/check.mjs

@@ -33,7 +33,7 @@ export async function runCheck() {
   step("build bailian-cli");
   run("pnpm", ["--filter", "bailian-cli", "run", "build"]);
 
-  step("pack + scan (publint, attw, gitleaks)");
+  step("pack + scan (publint, gitleaks)");
   packAndScan({ log });
 
   log("\nrelease check passed.");

tools/release/lib/pack-scan.mjs

@@ -13,10 +13,6 @@ function extractTarball(tarball, tempDir, key) {
   return extractDir;
 }
 
-/**
- * pnpm pack each package, then run publint / attw / gitleaks on the tarball
- * or the extracted directory. attw only runs on packages that declare types.
- */
 export function packAndScan({ log }) {
   const tempDir = mkdtempSync(join(tmpdir(), "bailian-release-"));
   try {
@@ -29,11 +25,6 @@ export function packAndScan({ log }) {
       log(`publint ${pkg.name}`);
       run("npx", ["--yes", "publint", extractDir]);
 
-      if (json.types) {
-        log(`attw ${pkg.name}`);
-        run("npx", ["--yes", "@arethetypeswrong/cli", "--pack", extractDir]);
-      }
-
       log(`gitleaks ${pkg.name}`);
       run("gitleaks", ["detect", "--source", extractDir, "--no-git", "--redact"]);
     }