Skip to content

build: typecheck CI and pin plugin range - #2

Merged
PentSec merged 2 commits into
mainfrom
chore/pin-plugin-range
Oct 29, 2026
Merged

PentSec merged 2 commits into
mainfrom
chore/pin-plugin-range

Conversation

@PentSec

@PentSec PentSec commented Oct 29, 2026

Copy link
Copy Markdown
Owner

Adds the missing typecheck gate and pins the plugin dependency range. No
runtime code changes.

Commits

  1. build: add typescript and a typecheck CI gate
    • typescript in devDependencies, typecheck script (tsc --noEmit)
    • ci.yml: npm ci + npm run typecheck on pull_request and on push
      to main
    • package-lock.json is now tracked: npm ci refuses to run without it,
      so the ignore line had to go with it
  2. build: pin @opencode/plugin to ^2.1.1
    • @opencode/plugin was declared as latest; the lockfile already
      resolves 2.1.1
    • the lock's root specifier moves with it so the recorded tree matches
      package.json

publish.yml is untouched.

Why the package lock is new

The repository had no committed lockfile, so there was no reproducible
install for CI to run against.

Local verification before opening

  • npm run typecheck → exit 0
  • npm ci + npm run typecheck in a clean copy → 374 packages, exit 0
  • resolved @opencode/plugin after npm ci → 2.1.1

ci.yml runs on this PR, so the same two commands run again here.

The package ships TypeScript sources that OpenCode compiles at load time,
so nothing on a pull request ever checked the types; publish.yml only runs
on a release, after a mistake can reach users.

- add `typescript` to devDependencies and a `typecheck` script
- add `ci.yml`: `npm ci` + `npm run typecheck` on pull_request and on push
  to main
- track `package-lock.json`: `npm ci` refuses to run without it, and the
  lock is what makes the install reproducible
The dependency was declared as "latest", so an install could pull a new
plugin major without a code change. The lockfile already resolves 2.1.1;
pin the major so a breaking release cannot arrive unnoticed.

Stacked on the lockfile commit because main has no committed
package-lock.json, and `npm ci` cannot run without one. The lock's root
specifier moves to ^2.1.1 as well so the recorded tree matches
package.json; `npm ci` tolerates the stale specifier, but the next
`npm install` would rewrite it anyway.
@PentSec
PentSec merged commit 16f6921 into main Oct 29, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant