Refactor publish workflow and environment variables (#261)

* feat: changelog generation

* refactor: rename all ENV variables to KILO prefix

* refactor: publish rework

* refactor: publish rework

* refactor: unify git commiter action

* refactor: add all kilobots to the team

.github/workflows/beta.yml

@@ -21,7 +21,7 @@ jobs:
         uses: ./.github/actions/setup-bun
 
       - name: Setup Git Committer
-        id: setup-git-committer
+        id: committer
         uses: ./.github/actions/setup-git-committer
         with:
           # kilocode_change start
@@ -31,5 +31,5 @@ jobs:
 
       - name: Sync beta branch
         env:
-          GH_TOKEN: ${{ steps.setup-git-committer.outputs.token }}
+          GH_TOKEN: ${{ steps.committer.outputs.token }}
         run: bun script/beta.ts

.github/workflows/check-org-member.yml

@@ -30,15 +30,15 @@ jobs:
           private-key: ${{ secrets['kilo-maintainer-app-secret'] }}
           owner: ${{ github.repository_owner }}
 
-      - name: Check if author is org member or kilo-maintainer bot
+      - name: Check if author is org member or kilo bot
         id: check
         env:
           GITHUB_TOKEN: ${{ steps.apptoken.outputs.token }}
           USERNAME: ${{ inputs.username }}
         run: |
-          if [[ "$USERNAME" == "kilo-maintainer[bot]" ]]; then
+          if [[ "$USERNAME" == "kilo-maintainer[bot]" || "$USERNAME" == "kiloconnect[bot]" || "$USERNAME" == "kiloconnect-lite[bot]" ]]; then
             echo "is-member=true" >> "$GITHUB_OUTPUT"
-            echo "User is kilo-maintainer bot"
+            echo "User is a kilo bot"
           elif gh api orgs/Kilo-Org/members/"$USERNAME" --silent 2>/dev/null; then
             echo "is-member=true" >> "$GITHUB_OUTPUT"
             echo "User is an org member"

.github/workflows/daily-issues-recap.yml

@@ -31,7 +31,7 @@ jobs:
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OPENCODE_PERMISSION: |
+          KILO_PERMISSION: |
             {
               "bash": {
                 "*": "deny",

.github/workflows/daily-pr-recap.yml

@@ -31,7 +31,7 @@ jobs:
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OPENCODE_PERMISSION: |
+          KILO_PERMISSION: |
             {
               "bash": {
                 "*": "deny",

.github/workflows/duplicate-issues.yml

@@ -28,7 +28,7 @@ jobs:
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OPENCODE_PERMISSION: |
+          KILO_PERMISSION: |
             {
               "bash": {
                 "*": "deny",

.github/workflows/generate.yml

@@ -19,7 +19,7 @@ jobs:
         uses: ./.github/actions/setup-bun
 
       - name: Setup Git Committer
-        id: setup-git-committer
+        id: committer
         uses: ./.github/actions/setup-git-committer
         with:
           # kilocode_change start

.github/workflows/nix-hashes.yml

@@ -87,11 +87,14 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.ref_name }}
 
-      - name: Setup git committer
+      - name: Setup Git Committer
+        id: committer
         uses: ./.github/actions/setup-git-committer
         with:
-          opencode-app-id: ${{ vars.OPENCODE_APP_ID }}
-          opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }}
+          # kilocode_change start
+          kilo-maintainer-app-id: ${{ secrets.KILO_MAINTAINER_APP_ID }}
+          kilo-maintainer-app-secret: ${{ secrets.KILO_MAINTAINER_APP_SECRET }}
+          # kilocode_change end
 
       - name: Pull latest changes
         run: |

.github/workflows/opencode.yml

@@ -33,6 +33,6 @@ jobs:
         uses: Kilo-Org/kilo/github@latest
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          OPENCODE_PERMISSION: '{"bash": "deny"}'
+          KILO_PERMISSION: '{"bash": "deny"}'
         with:
           model: opencode/claude-opus-4-5

.github/workflows/publish-stable.yml

@@ -1,99 +0,0 @@
-# kilocode_change - new file
-#
-# Stable Release Workflow for Kilo CLI
-# =====================================
-#
-# HOW TO RELEASE:
-# 1. Go to GitHub Actions → publish-stable
-# 2. Click "Run workflow"
-# 3. Enter the version (e.g., 1.0.0) - REQUIRED for stable releases
-# 4. Click "Run workflow"
-#
-# HOW USERS INSTALL:
-#   npm install -g @kilocode/cli
-#
-# REQUIRED GITHUB SECRETS:
-# - NPM_TOKEN: npm authentication token with publish access to @kilocode/cli
-#   (Get from: npmjs.com → Access Tokens → Generate New Token → Automation)
-#
-# WHAT THIS DOES:
-# - Runs the existing publish-start.ts script with OPENCODE_CHANNEL=latest
-# - Builds all platform binaries (Linux, macOS, Windows, x64, ARM64)
-# - Publishes to npm with @latest tag (default for npm install)
-# - Creates git tags and GitHub releases
-# - Includes npm provenance attestation for supply chain security
-#
-name: publish-stable
-run-name: "stable release v${{ inputs.version }}"
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to release (e.g., 1.0.0)"
-        required: true
-        type: string
-
-concurrency: ${{ github.workflow }}-${{ github.ref }}-${{ inputs.version }}
-
-permissions:
-  id-token: write
-  contents: write
-  packages: write
-
-jobs:
-  publish-stable:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - run: git fetch --force --tags
-
-      - uses: ./.github/actions/setup-bun
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "24"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Setup Git Identity
-        run: |
-          git config --global user.email "kilocode@kilo.ai"
-          git config --global user.name "kilocode"
-
-      - name: Publish Stable
-        run: ./script/publish-start.ts
-        env:
-          OPENCODE_CHANNEL: latest
-          OPENCODE_VERSION: ${{ inputs.version }}
-          OPENCODE_SKIP_NOTES: "1"
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Update Homebrew Tap
-        run: |
-          curl -f -X POST \
-            -H "Authorization: token ${{ secrets.KILO_GITHUB_TOKEN }}" \
-            -H "Content-Type: application/json" \
-            https://api.github.com/repos/Kilo-Org/homebrew-tap/dispatches \
-            -d '{"event_type": "update-formula", "client_payload": {"version": "${{ inputs.version }}"}}'
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: kilocode-cli-stable
-          path: packages/opencode/dist

.github/workflows/publish.yml

@@ -2,10 +2,12 @@ name: publish
 run-name: "${{ format('release {0}', inputs.bump) }}"
 
 on:
-  push:
-    branches:
-      - dev
-      - snapshot-*
+  # push:
+  #   branches:
+  #     - ci
+  #     - dev
+  #     - beta
+  #     - snapshot-*
   workflow_dispatch:
     inputs:
       bump:
@@ -29,23 +31,188 @@ permissions:
   packages: write
 
 jobs:
-  publish:
+  version:
     runs-on: blacksmith-4vcpu-ubuntu-2404
-    # kilocode_change start - disabled for kilo-cli fork (OpenCode npm/AUR publishing)
-    if: false
-    # kilocode_change end - original: if: github.repository == 'Kilo-Org/kilo'
+    if: github.repository == 'Kilo-Org/kilo'
     steps:
       - uses: actions/checkout@v3
         with:
           fetch-depth: 0
 
-      - run: git fetch --force --tags
+      - uses: ./.github/actions/setup-bun
+
+      - name: Install Kilo
+        if: inputs.bump || inputs.version
+        run: bun i -g @kilocode/cli
+
+      - id: version
+        run: |
+          ./script/version.ts
+        env:
+          GH_TOKEN: ${{ github.token }}
+          KILO_BUMP: ${{ inputs.bump }}
+          KILO_VERSION: ${{ inputs.version }}
+          KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
+          KILO_ORG_ID: ${{ secrets.KILO_ORG_ID }}
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      release: ${{ steps.version.outputs.release }}
+      tag: ${{ steps.version.outputs.tag }}
+
+  build-cli:
+    needs: version
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    if: github.repository == 'Kilo-Org/kilo'
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-tags: true
 
       - uses: ./.github/actions/setup-bun
 
-      - name: Install OpenCode
-        if: inputs.bump || inputs.version
-        run: bun i -g opencode-ai@1.0.169
+      - name: Build
+        id: build
+        run: |
+          ./packages/opencode/script/build.ts
+        env:
+          KILO_VERSION: ${{ needs.version.outputs.version }}
+          KILO_RELEASE: ${{ needs.version.outputs.release }}
+          GH_TOKEN: ${{ github.token }}
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: kilo-cli
+          path: packages/opencode/dist
+
+    outputs:
+      version: ${{ needs.version.outputs.version }}
+
+  # build-tauri:
+  #   needs:
+  #     - build-cli
+  #     - version
+  #   continue-on-error: false
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       settings:
+  #         - host: macos-latest
+  #           target: x86_64-apple-darwin
+  #         - host: macos-latest
+  #           target: aarch64-apple-darwin
+  #         - host: blacksmith-4vcpu-windows-2025
+  #           target: x86_64-pc-windows-msvc
+  #         - host: blacksmith-4vcpu-ubuntu-2404
+  #           target: x86_64-unknown-linux-gnu
+  #         - host: blacksmith-8vcpu-ubuntu-2404-arm
+  #           target: aarch64-unknown-linux-gnu
+  #   runs-on: ${{ matrix.settings.host }}
+  #   steps:
+  #     - uses: actions/checkout@v3
+  #       with:
+  #         fetch-tags: true
+
+  #     - uses: apple-actions/import-codesign-certs@v2
+  #       if: ${{ runner.os == 'macOS' }}
+  #       with:
+  #         keychain: build
+  #         p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
+  #         p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+
+  #     - name: Verify Certificate
+  #       if: ${{ runner.os == 'macOS' }}
+  #       run: |
+  #         CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application")
+  #         CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
+  #         echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
+  #         echo "Certificate imported."
+
+  #     - name: Setup Apple API Key
+  #       if: ${{ runner.os == 'macOS' }}
+  #       run: |
+  #         echo "${{ secrets.APPLE_API_KEY_PATH }}" > $RUNNER_TEMP/apple-api-key.p8
+
+  #     - uses: ./.github/actions/setup-bun
+
+  #     - name: Cache apt packages
+  #       if: contains(matrix.settings.host, 'ubuntu')
+  #       uses: actions/cache@v4
+  #       with:
+  #         path: /var/cache/apt/archives
+  #         key: ${{ runner.os }}-${{ matrix.settings.target }}-apt-${{ hashFiles('.github/workflows/publish.yml') }}
+  #         restore-keys: |
+  #           ${{ runner.os }}-${{ matrix.settings.target }}-apt-
+
+  #     - name: install dependencies (ubuntu only)
+  #       if: contains(matrix.settings.host, 'ubuntu')
+  #       run: |
+  #         sudo apt-get update
+  #         sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
+
+  #     - name: install Rust stable
+  #       uses: dtolnay/rust-toolchain@stable
+  #       with:
+  #         targets: ${{ matrix.settings.target }}
+
+  #     - uses: Swatinem/rust-cache@v2
+  #       with:
+  #         workspaces: packages/desktop/src-tauri
+  #         shared-key: ${{ matrix.settings.target }}
+
+  #     - name: Prepare
+  #       run: |
+  #         cd packages/desktop
+  #         bun ./scripts/prepare.ts
+  #       env:
+  #         KILO_VERSION: ${{ needs.version.outputs.version }}
+  #         GITHUB_TOKEN: ${{ steps.committer.outputs.token }}
+  #         RUST_TARGET: ${{ matrix.settings.target }}
+  #         GH_TOKEN: ${{ github.token }}
+  #         GITHUB_RUN_ID: ${{ github.run_id }}
+
+  #     # Fixes AppImage build issues, can be removed when https://github.com/tauri-apps/tauri/pull/12491 is released
+  #     - name: Install tauri-cli from portable appimage branch
+  #       if: contains(matrix.settings.host, 'ubuntu')
+  #       run: |
+  #         cargo install tauri-cli --git https://github.com/tauri-apps/tauri --branch feat/truly-portable-appimage --force
+  #         echo "Installed tauri-cli version:"
+  #         cargo tauri --version
+
+  #     - name: Build and upload artifacts
+  #       uses: tauri-apps/tauri-action@390cbe447412ced1303d35abe75287949e43437a
+  #       timeout-minutes: 60
+  #       with:
+  #         projectPath: packages/desktop
+  #         uploadWorkflowArtifacts: true
+  #         tauriScript: ${{ (contains(matrix.settings.host, 'ubuntu') && 'cargo tauri') || '' }}
+  #         args: --target ${{ matrix.settings.target }} --config ./src-tauri/tauri.prod.conf.json --verbose
+  #         updaterJsonPreferNsis: true
+  #         releaseId: ${{ needs.version.outputs.release }}
+  #         tagName: ${{ needs.version.outputs.tag }}
+  #         releaseDraft: true
+  #         releaseAssetNamePattern: opencode-desktop-[platform]-[arch][ext]
+  #       env:
+  #         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  #         TAURI_BUNDLER_NEW_APPIMAGE_FORMAT: true
+  #         TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+  #         TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+  #         APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+  #         APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+  #         APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
+  #         APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+  #         APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+  #         APPLE_API_KEY_PATH: ${{ runner.temp }}/apple-api-key.p8
+
+  publish:
+    needs:
+      - version
+      - build-cli
+      # - build-tauri
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: ./.github/actions/setup-bun
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
@@ -65,161 +232,27 @@ jobs:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
 
-      - name: Setup Git Identity
-        run: |
-          git config --global user.email "opencode@sst.dev"
-          git config --global user.name "opencode"
-          git remote set-url origin https://x-access-token:${{ secrets.SST_GITHUB_TOKEN }}@github.com/${{ github.repository }}
-
-      - name: Publish
-        id: publish
-        run: ./script/publish-start.ts
-        env:
-          OPENCODE_BUMP: ${{ inputs.bump }}
-          OPENCODE_VERSION: ${{ inputs.version }}
-          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          AUR_KEY: ${{ secrets.AUR_KEY }}
-          GITHUB_TOKEN: ${{ secrets.SST_GITHUB_TOKEN }}
-          NPM_CONFIG_PROVENANCE: false
-
-      - uses: actions/upload-artifact@v4
+      - name: Setup Git Committer
+        id: committer
+        uses: ./.github/actions/setup-git-committer
         with:
-          name: opencode-cli
+          # kilocode_change start
+          kilo-maintainer-app-id: ${{ secrets.KILO_MAINTAINER_APP_ID }}
+          kilo-maintainer-app-secret: ${{ secrets.KILO_MAINTAINER_APP_SECRET }}
+          # kilocode_change end
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: kilo-cli
           path: packages/opencode/dist
 
-    outputs:
-      release: ${{ steps.publish.outputs.release }}
-      tag: ${{ steps.publish.outputs.tag }}
-      version: ${{ steps.publish.outputs.version }}
-
-  publish-tauri:
-    needs: publish
-    continue-on-error: false
-    strategy:
-      fail-fast: false
-      matrix:
-        settings:
-          - host: macos-latest
-            target: x86_64-apple-darwin
-          - host: macos-latest
-            target: aarch64-apple-darwin
-          - host: blacksmith-4vcpu-windows-2025
-            target: x86_64-pc-windows-msvc
-          - host: blacksmith-4vcpu-ubuntu-2404
-            target: x86_64-unknown-linux-gnu
-          - host: blacksmith-8vcpu-ubuntu-2404-arm
-            target: aarch64-unknown-linux-gnu
-    runs-on: ${{ matrix.settings.host }}
-    steps:
-      - uses: actions/checkout@v3
+      - name: Cache apt packages (AUR)
+        uses: actions/cache@v4
         with:
-          fetch-depth: 0
-          ref: ${{ needs.publish.outputs.tag }}
-
-      - uses: apple-actions/import-codesign-certs@v2
-        if: ${{ runner.os == 'macOS' }}
-        with:
-          keychain: build
-          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
-          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-
-      - name: Verify Certificate
-        if: ${{ runner.os == 'macOS' }}
-        run: |
-          CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application")
-          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
-          echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
-          echo "Certificate imported."
-
-      - name: Setup Apple API Key
-        if: ${{ runner.os == 'macOS' }}
-        run: |
-          echo "${{ secrets.APPLE_API_KEY_PATH }}" > $RUNNER_TEMP/apple-api-key.p8
-
-      - run: git fetch --force --tags
-
-      - uses: ./.github/actions/setup-bun
-
-      - name: install dependencies (ubuntu only)
-        if: contains(matrix.settings.host, 'ubuntu')
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
-
-      - name: install Rust stable
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.settings.target }}
-
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: packages/desktop/src-tauri
-          shared-key: ${{ matrix.settings.target }}
-
-      - name: Prepare
-        run: |
-          cd packages/desktop
-          bun ./scripts/prepare.ts
-        env:
-          OPENCODE_VERSION: ${{ needs.publish.outputs.version }}
-          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.SST_GITHUB_TOKEN }}
-          AUR_KEY: ${{ secrets.AUR_KEY }}
-          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          RUST_TARGET: ${{ matrix.settings.target }}
-          GH_TOKEN: ${{ github.token }}
-          GITHUB_RUN_ID: ${{ github.run_id }}
-
-      # Fixes AppImage build issues, can be removed when https://github.com/tauri-apps/tauri/pull/12491 is released
-      - name: Install tauri-cli from portable appimage branch
-        if: contains(matrix.settings.host, 'ubuntu')
-        run: |
-          cargo install tauri-cli --git https://github.com/tauri-apps/tauri --branch feat/truly-portable-appimage --force
-          echo "Installed tauri-cli version:"
-          cargo tauri --version
-
-      - name: Build and upload artifacts
-        uses: Wandalen/wretry.action@v3
-        timeout-minutes: 60
-        with:
-          attempt_limit: 3
-          attempt_delay: 10000
-          action: tauri-apps/tauri-action@390cbe447412ced1303d35abe75287949e43437a
-          with: |
-            projectPath: packages/desktop
-            uploadWorkflowArtifacts: true
-            tauriScript: ${{ (contains(matrix.settings.host, 'ubuntu') && 'cargo tauri') || '' }}
-            args: --target ${{ matrix.settings.target }} --config ./src-tauri/tauri.prod.conf.json --verbose
-            updaterJsonPreferNsis: true
-            releaseId: ${{ needs.publish.outputs.release }}
-            tagName: ${{ needs.publish.outputs.tag }}
-            releaseAssetNamePattern: kilo-desktop-[platform]-[arch][ext]
-            releaseDraft: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAURI_BUNDLER_NEW_APPIMAGE_FORMAT: true
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
-          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
-          APPLE_API_KEY_PATH: ${{ runner.temp }}/apple-api-key.p8
-
-  publish-release:
-    needs:
-      - publish
-      - publish-tauri
-    if: needs.publish.outputs.tag
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-          ref: ${{ needs.publish.outputs.tag }}
-
-      - uses: ./.github/actions/setup-bun
+          path: /var/cache/apt/archives
+          key: ${{ runner.os }}-apt-aur-${{ hashFiles('.github/workflows/publish.yml') }}
+          restore-keys: |
+            ${{ runner.os }}-apt-aur-
 
       - name: Setup SSH for AUR
         run: |
@@ -228,12 +261,15 @@ jobs:
           mkdir -p ~/.ssh
           echo "${{ secrets.AUR_KEY }}" > ~/.ssh/id_rsa
           chmod 600 ~/.ssh/id_rsa
-          git config --global user.email "opencode@sst.dev"
-          git config --global user.name "opencode"
+          git config --global user.email "hi@kilo.ai"
+          git config --global user.name "kilo-maintainer[bot]"
           ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts || true
 
-      - run: ./script/publish-complete.ts
+      - run: ./script/publish.ts
         env:
-          OPENCODE_VERSION: ${{ needs.publish.outputs.version  }}
+          KILO_VERSION: ${{ needs.version.outputs.version }}
+          KILO_RELEASE: ${{ needs.version.outputs.release }}
           AUR_KEY: ${{ secrets.AUR_KEY }}
-          GITHUB_TOKEN: ${{ secrets.SST_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.committer.outputs.token }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true

.github/workflows/review.yml

@@ -51,7 +51,7 @@ jobs:
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OPENCODE_PERMISSION: '{ "bash": {  "*": "deny", "gh*": "allow", "gh pr review*": "deny" } }'
+          KILO_PERMISSION: '{ "bash": {  "*": "deny", "gh*": "allow", "gh pr review*": "deny" } }'
           PR_TITLE: ${{ steps.pr-details.outputs.title }}
         run: |
           PR_BODY=$(jq -r .body pr_data.json)

.github/workflows/test.yml

@@ -69,7 +69,6 @@ jobs:
           # kilocode_change start
           KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
           KILO_ORG_ID: ${{ secrets.KILO_ORG_ID }}
-          OPENCODE_DISABLE_SHARE: "true"
           KILO_DISABLE_SHARE: "true"
           KILO_DISABLE_SESSION_INGEST: "true"
           # kilocode_change end