fix: publish Photon OpenAPI packages and preserve reusable responses (#1)

Author: underthestars-zhy

.github/workflows/changelog-preview.yml

@@ -1,108 +1,34 @@
-name: Publish
+name: Publish GitHub Package
+
 on:
-  issues:
-    types: [labeled]
+  workflow_dispatch:
 
 permissions:
-  actions: read
-  contents: write
-  issues: write
-  id-token: write
+  contents: read
+  packages: write
+
+concurrency:
+  group: publish-hono-openapi
+  cancel-in-progress: false
 
 jobs:
   publish:
-    if: >-
-      github.event.label.name == 'accepted' &&
-      github.event.issue.state == 'open'
+    if: github.repository == 'photon-hq/hono-openapi' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
-    name: Publish release
-    timeout-minutes: 15
     steps:
-      - name: Generate GitHub App token
-        id: token
-        uses: actions/create-github-app-token@v2
-        with:
-          app-id: ${{ vars.CRAFT_APP_ID }}
-          private-key: ${{ secrets.CRAFT_APP_PRIVATE_KEY }}
-
-      - name: Parse version from issue title
-        id: release
-        env:
-          ISSUE_TITLE: ${{ github.event.issue.title }}
-        run: |
-          set -euo pipefail
-          # Title: "publish: <owner>/<repo>@<version>"
-          version="${ISSUE_TITLE##*@}"
-          if [[ -z "$version" ]]; then
-            echo "::error::Could not parse version from title: $ISSUE_TITLE"
-            exit 1
-          fi
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-          echo "branch=release/$version" >> "$GITHUB_OUTPUT"
-
-      - uses: actions/checkout@v4
-        with:
-          ref: release/${{ steps.release.outputs.version }}
-          token: ${{ steps.token.outputs.token }}
-          fetch-depth: 0
-
-      - uses: pnpm/action-setup@v4
-
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Set git user
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-      - name: Ensure npm supports trusted publishing
-        run: npm install -g npm@latest
-
-      - name: Install Craft
-        run: |
-          CRAFT_URL=$(curl -fsSL https://api.github.com/repos/getsentry/craft/releases/latest \
-            | jq -r '.assets[] | select(.name == "craft") | .browser_download_url')
-          sudo curl -fsSL -o /usr/local/bin/craft "$CRAFT_URL"
-          sudo chmod +x /usr/local/bin/craft
-
-      - name: Wait for package artifacts on release branch
+          cache: pnpm
+          registry-url: https://npm.pkg.github.com
+          scope: '@photon-hq'
+      - run: pnpm install --frozen-lockfile
         env:
-          GH_TOKEN: ${{ steps.token.outputs.token }}
-        run: |
-          set -euo pipefail
-          branch="${{ steps.release.outputs.branch }}"
-          echo "Waiting for Package Artifacts on $branch..."
-          run_id=$(gh run list --workflow "Package Artifacts" --branch "$branch" \
-            --json databaseId --jq '.[0].databaseId')
-          if [[ -z "$run_id" || "$run_id" == "null" ]]; then
-            echo "::error::No Package Artifacts run found for branch $branch"
-            exit 1
-          fi
-          gh run watch "$run_id" --exit-status
-
-      - name: Publish with Craft
-        run: craft publish "${{ steps.release.outputs.version }}" --no-input --no-status-check
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_API_TOKEN: ${{ steps.token.outputs.token }}
-
-      - name: Close issue on success
-        if: success()
-        env:
-          GH_TOKEN: ${{ steps.token.outputs.token }}
-        run: |
-          gh issue close "${{ github.event.issue.number }}" \
-            --comment "Published **v${{ steps.release.outputs.version }}** successfully.
-          [Workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
-
-      - name: Handle failure
-        if: failure()
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: pnpm test --run
+      - run: pnpm build
+      - run: pnpm publish --tag latest --no-git-checks
         env:
-          GH_TOKEN: ${{ steps.token.outputs.token }}
-        run: |
-          gh issue comment "${{ github.event.issue.number }}" \
-            --body "Publish failed. See [run logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})."
-          gh issue edit "${{ github.event.issue.number }}" --remove-label accepted
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/package-artifacts.yml

@@ -1,24 +1,29 @@
-name: CI Tests
-on: [push, pull_request]
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+  packages: read
 
 jobs:
-  test:
+  verify:
     runs-on: ubuntu-latest
-
     steps:
-      - uses: actions/checkout@v5
-
-      - name: Use Node.js 22.x
-        uses: actions/setup-node@v5
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v6
         with:
-          node-version: 22.x
-          package-manager-cache: false
-
-      - name: Install PNPM
-        uses: pnpm/action-setup@v4
-
-      - name: Install dependencies
-        run: pnpm install
-
-      - name: Run tests
-        run: pnpm test
+          node-version: 24
+          cache: pnpm
+          registry-url: https://npm.pkg.github.com
+          scope: '@photon-hq'
+      - run: pnpm install --frozen-lockfile
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: pnpm test --run
+      - run: pnpm build
+      - run: pnpm pack

.github/workflows/publish.yml

@@ -0,0 +1 @@
+@photon-hq:registry=https://npm.pkg.github.com

.github/workflows/release-preview.yml

@@ -0,0 +1,22 @@
+# Photon package
+
+`@photon-hq/hono-openapi` is published to GitHub Packages.
+
+Version `1.3.1-photon.1` uses upstream commit
+`ce39f12976028681f752c98cc0e7108db5cc96c0` and pins
+`@photon-hq/standard-openapi@0.2.9-photon.1` as a runtime dependency. That converter
+includes the upstream fix for recursive definitions that otherwise produce
+dangling `#/components/schemas/*` references.
+
+The Photon patch resolves response schemas into copies. Upstream mutates shared
+route metadata and documentation responses, which can discard components when
+generating another document from the same endpoint. The regression tests cover
+repeated generation and separate apps sharing route or component responses.
+
+To publish a new version, update `package.json` and the lockfile, merge to `main`,
+then run the **Publish GitHub Package** workflow. Versions are immutable;
+increment the `-photon.N` suffix for Photon changes to the same upstream version.
+The workflow publishes with its repository's `GITHUB_TOKEN`.
+
+Keep the upstream MIT license and compare the response-copy patch when syncing
+upstream or switching consumers back to the upstream package.