From 1071317ef28d13127a6e1747435ea111a7c22d03 Mon Sep 17 00:00:00 2001
From: minhn4 <nguyenm.cuny@gmail.com>
Date: Tue, 7 Jul 2026 10:10:19 +0700
Subject: [PATCH] chore: remove publish workflow, local publishing only

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/publish-codev.yml | 71 -----------------------------
 DIVERGENCES.md                      |  9 ++--
 2 files changed, 5 insertions(+), 75 deletions(-)
 delete mode 100644 .github/workflows/publish-codev.yml

diff --git a/.github/workflows/publish-codev.yml b/.github/workflows/publish-codev.yml
deleted file mode 100644
index 141269d661..0000000000
--- a/.github/workflows/publish-codev.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: publish-codev
-
-# Publishes codev-code (+ platform binary packages) to npm. Unscoped npm
-# packages are always PUBLIC. Manual-only: versioning is explicit, no
-# auto-bumps.
-#
-# Required repo secrets:
-#   CODEV_NPM_TOKEN     auth token (npm automation token for npmjs, or the
-#                       self-hosted registry's token)
-# Optional:
-#   CODEV_NPM_REGISTRY  defaults to https://registry.npmjs.org (packages are
-#                       published with restricted access)
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to publish (e.g. 1.0.0)"
-        required: true
-      channel:
-        description: "npm dist-tag"
-        default: "latest"
-        required: false
-
-concurrency: publish-codev
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-
-      - name: Install dependencies
-        run: bun install
-
-      - name: Configure npm for the private registry
-        env:
-          REGISTRY: ${{ secrets.CODEV_NPM_REGISTRY }}
-          TOKEN: ${{ secrets.CODEV_NPM_TOKEN }}
-        run: |
-          if [ -z "$TOKEN" ]; then
-            echo "::error::The CODEV_NPM_TOKEN secret must be set."
-            exit 1
-          fi
-          REGISTRY="${REGISTRY:-https://registry.npmjs.org}"
-          # Point npm at the registry and attach the auth token to that host
-          # (npmrc's //host/path:_authToken form).
-          hostpath="${REGISTRY#*://}"
-          hostpath="${hostpath%/}"
-          {
-            echo "registry=${REGISTRY%/}/"
-            echo "//${hostpath}/:_authToken=${TOKEN}"
-          } >> ~/.npmrc
-
-      - name: Build all platform binaries
-        working-directory: packages/opencode
-        env:
-          OPENCODE_VERSION: ${{ inputs.version }}
-          OPENCODE_CHANNEL: ${{ inputs.channel }}
-        run: bun run script/build.ts
-
-      - name: Publish to private registry
-        working-directory: packages/opencode
-        env:
-          OPENCODE_VERSION: ${{ inputs.version }}
-          OPENCODE_CHANNEL: ${{ inputs.channel }}
-        run: bun run script/publish.ts
diff --git a/DIVERGENCES.md b/DIVERGENCES.md
index d3e92d1206..572d5af759 100644
--- a/DIVERGENCES.md
+++ b/DIVERGENCES.md
@@ -31,10 +31,11 @@ future `packages/codev-*`) never conflict and are not tracked here.
   direct `codev-code upgrade` would still install stock opencode. Patch or disable the
   upgrade command before distributing outside the team.
 - **Publishing**: npm packages publish as `codev-code` / `codev-code-<platform>` — unscoped,
-  therefore PUBLIC on npmjs (like `codev-ai`) — via `.github/workflows/publish-codev.yml`
-  (manual dispatch; requires the `CODEV_NPM_TOKEN` secret and an explicit version; registry
-  defaults to npmjs). Docker/AUR/Homebrew/GitHub-release channels are upstream-only and
-  disabled. The binary inside platform packages is still named `opencode` (cosmetic).
+  therefore PUBLIC on npmjs (like `codev-ai`). Local-only for now (no CI workflow), run from
+  `packages/opencode` with npm publish auth in place:
+  `OPENCODE_VERSION=<x.y.z> OPENCODE_CHANNEL=latest bun run script/build.ts && bun run script/publish.ts`.
+  Docker/AUR/Homebrew/GitHub-release channels are upstream-only and disabled. The binary
+  inside platform packages is still named `opencode` (cosmetic).
 - **UI branding**: TUI logo (`UI.logo()`), desktop/web app names and assets — all still
   upstream-branded. Cosmetic; not worth the merge-conflict surface until the product ships
   beyond the team.