update release CI (#97)

<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Introduces stricter quality gates and centralizes environment management while refining type handling across packages.
> 
> - **CI/CD**: Split `continuous-release` into `lint`, `typecheck`, `test` (incl. 1Password + `@proofkit/fmodata` E2E), and `build`; `release.yml` adds manual trigger, TURBO env, and a `quality` job gating publish
> - **Secrets/ENV**: New root `op.env`; removes per-package `op.env` and updates scripts to reference `../../op.env`
> - **Tooling**: Adds `typecheck` scripts across packages and a Turbo `typecheck` task; bumps `turbo` and `pnpm`; small lint script tweaks
> - **CLI/Deploy**: Safer handling of `envFile` (defaults to `.env`); fixes category typing; improves provider wrapping types
> - **Typegen/Generators**: Normalizes data source config (default `type: "fmdapi"`), narrows types to `FmdapiDataSourceConfig`, and filters ops by type
> - **Registry**: Replaces `shadcn` type imports with local lightweight schemas; updates `registry` package scripts
> - **Auth installer**: Ensures added config includes `type: "fmdapi"` and explicit `envNames: undefined`
> 
> <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit e0cc7d3. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: eluce2

.github/workflows/continuous-release.yml

@@ -1,10 +1,79 @@
 name: Publish Any Commit
 on: [push, pull_request]
 
+env:
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+
 jobs:
-  build:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - run: corepack enable
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm lint
+
+  typecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - run: corepack enable
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Type Check
+        run: pnpm typecheck
+
+  test:
     runs-on: ubuntu-latest
+    needs: [lint, typecheck]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
 
+      - run: corepack enable
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install 1Password CLI
+        uses: 1password/install-cli-action@v1
+
+      - name: Run Unit Tests
+        run: op run --env-file=op.env -- pnpm test
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+      - name: Run fmodata E2E Tests
+        run: op run --env-file=op.env -- pnpm --filter @proofkit/fmodata test:e2e:ci
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+  build:
+    runs-on: ubuntu-latest
+    needs: [test]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -20,4 +89,5 @@ jobs:
 
       - name: Build
         run: pnpm build
+
       - run: pnpm dlx pkg-pr-new publish './packages/*' --packageManager=pnpm

.github/workflows/release.yml

@@ -1,21 +1,65 @@
 name: Release
 
 on:
+  workflow_dispatch:
+
   push:
     branches:
       - main
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+env:
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+
 permissions:
-  # Changesets/action needs to push version commits and open/update a PR
   contents: write
   pull-requests: write
-  id-token: write # Required for OIDC
+  id-token: write
 
 jobs:
+  quality:
+    name: Quality Checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Setup Node.js 22.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: "pnpm"
+
+      - name: Install Dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Type Check
+        run: pnpm typecheck
+
+      - name: Install 1Password CLI
+        uses: 1password/install-cli-action@v1
+
+      - name: Run Tests
+        run: op run --env-file=op.env -- pnpm test
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+      - name: Run fmodata E2E Tests
+        run: op run --env-file=op.env -- pnpm --filter @proofkit/fmodata test:e2e:ci
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
   release:
     name: Release
+    needs: [quality]
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
@@ -38,9 +82,7 @@ jobs:
         id: changesets
         uses: changesets/action@v1
         with:
-          # This expects you to have a script called release which does a build for your packages and calls changeset publish
           publish: pnpm release
         env:
           GITHUB_TOKEN: ${{ github.token }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
           NPM_CONFIG_PROVENANCE: true

packages/typegen/op.env op.envpackages/typegen/op.env renamed to op.env

@@ -5,22 +5,27 @@
 #   | | |  | (_| \__ \__ \\ V  V / (_) | | | (_| ||  __/ | | \ V /
 #   |_|_|   \__,_|___/___/ \_/\_/ \___/|_|  \__,_(_)___|_| |_|\_/
 #
-# This file is intentionally commited to source control.
+# This file is intentionally committed to source control.
 # It should only reference secrets in 1Password
 
-DIFFERENT_FM_SERVER="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/1Password env Values/FM_SERVER"
-DIFFERENT_FM_DATABASE="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/1Password env Values/FM_DATABASE"
-DIFFERENT_OTTO_API_KEY="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/1Password env Values/OTTO_API_KEY"
-
+# fmdapi & typegen secrets
 FM_SERVER="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/1Password env Values/FM_SERVER"
 FM_DATABASE="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/1Password env Values/FM_DATABASE"
 OTTO_API_KEY="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/1Password env Values/OTTO_API_KEY"
 FM_USERNAME="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/username"
 FM_PASSWORD="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/password"
-
-# Test environment variables
+DIFFERENT_FM_SERVER="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/1Password env Values/FM_SERVER"
+DIFFERENT_FM_DATABASE="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/1Password env Values/FM_DATABASE"
+DIFFERENT_OTTO_API_KEY="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/1Password env Values/OTTO_API_KEY"
 TEST_FM_SERVER="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/1Password env Values/FM_SERVER"
 TEST_FM_DATABASE="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/1Password env Values/FM_DATABASE"
 TEST_OTTO_API_KEY="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/1Password env Values/OTTO_API_KEY"
 TEST_USERNAME="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/username"
 TEST_PASSWORD="op://xrs5sehh2gm36me62rlfpmsyde/ztcjgvgc4i5aa6cjh5vudpco4m/password"
+
+# fmodata secrets
+FMODATA_SERVER_URL="op://xrs5sehh2gm36me62rlfpmsyde/fmdapi_test/1Password env Values/FM_SERVER"
+FMODATA_DATABASE="op://xrs5sehh2gm36me62rlfpmsyde/fmdapi_test/1Password env Values/FM_DATABASE"
+FMODATA_API_KEY="op://xrs5sehh2gm36me62rlfpmsyde/fmdapi_test/1Password env Values/OTTO_API_KEY"
+FMODATA_USERNAME="op://xrs5sehh2gm36me62rlfpmsyde/fmdapi_test/username"
+FMODATA_PASSWORD="op://xrs5sehh2gm36me62rlfpmsyde/fmdapi_test/password"

package.json

@@ -4,6 +4,7 @@
     "build": "turbo run build --filter={./packages/*} --filter=@proofkit/docs",
     "dev": "turbo run dev",
     "lint": "turbo run lint",
+    "typecheck": "turbo run typecheck",
     "clean": "turbo run clean && rm -rf node_modules",
     "format": "biome format --write .",
     "changeset": "changeset",
@@ -22,12 +23,12 @@
     "husky": "^9.1.7",
     "knip": "^5.56.0",
     "lint-staged": "^16.2.7",
-    "turbo": "^2.5.4",
+    "turbo": "^2.7.3",
     "typescript": "^5.9.3",
     "ultracite": "7.0.8",
     "vitest": "^4.0.7"
   },
-  "packageManager": "pnpm@10.14.0",
+  "packageManager": "pnpm@10.27.0",
   "engines": {
     "node": ">=18"
   },

packages/better-auth/package.json

@@ -7,6 +7,7 @@
   "scripts": {
     "dev": "pnpm build:watch",
     "test": "vitest run",
+    "typecheck": "tsc --noEmit",
     "build": "vite build && publint --strict",
     "build:watch": "vite build --watch",
     "ci": "pnpm run build && pnpm run test",

packages/cli/package.json

@@ -45,10 +45,8 @@
     "dev": "tsdown --watch",
     "clean": "rm -rf dist .turbo node_modules",
     "start": "node dist/index.js",
-    "lint": "biome check .",
+    "lint": "biome check . --write",
     "lint:summary": "biome check . --reporter=summary",
-    "format": "biome format --write .",
-    "format:check": "biome format --check .",
     "release": "changeset version",
     "pub:beta": "NODE_ENV=production pnpm build && npm publish --tag beta --access public",
     "pub:next": "NODE_ENV=production pnpm build && npm publish --tag next --access public",

packages/cli/src/cli/add/index.ts

@@ -1,8 +1,8 @@
 import { select } from "@clack/prompts";
+import type { RegistryIndex } from "@proofkit/registry";
 import { Command } from "commander";
 import { capitalize, groupBy, uniq } from "es-toolkit";
 import ora from "ora";
-
 import { ciOption, debugOption } from "~/globalOptions.js";
 import { initProgramState, state } from "~/state.js";
 import { logger } from "~/utils/logger.js";
@@ -77,7 +77,7 @@ const runAddFromRegistry = async (_options?: { noInstall?: boolean }) => {
     await runAddSchemaAction();
   } else if (addType === "data") {
     await runAddDataSourceCommand();
-  } else if (categories.includes(addType)) {
+  } else if ((categories as string[]).includes(addType)) {
     // one of the categories
     const itemsFromCategory = groupedByCategory[addType as keyof typeof groupedByCategory];
 

packages/cli/src/cli/add/registry/postInstall/wrap-provider.ts

@@ -1,6 +1,6 @@
 import path from "node:path";
 import type { PostInstallStep } from "@proofkit/registry";
-import { type ImportDeclarationStructure, StructureKind, SyntaxKind } from "ts-morph";
+import { type ImportDeclarationStructure, type JsxChild, type JsxElement, StructureKind, SyntaxKind } from "ts-morph";
 
 import { getShadcnConfig } from "~/helpers/shadcn-cli.js";
 import { state } from "~/state.js";
@@ -66,9 +66,7 @@ export async function wrapProvider(step: Extract<PostInstallStep, { action: "wra
       return;
     }
 
-    let targetElement: ReturnType<
-      (typeof returnStatement.getDescendantsOfKind<typeof SyntaxKind.JsxOpeningElement>)[number]["getParentIfKind"]
-    >;
+    let targetElement: JsxElement | undefined;
 
     // Try to find the parent tag if specified
     if (parentTag && parentTag.length > 0) {
@@ -88,7 +86,7 @@ export async function wrapProvider(step: Extract<PostInstallStep, { action: "wra
       // If we found a parent tag, wrap its children
       const childrenText = targetElement
         ?.getJsxChildren()
-        .map((child) => child.getText())
+        .map((child: JsxChild) => child.getText())
         .filter(Boolean)
         .join("\n");
 

packages/cli/src/cli/deploy/index.ts

@@ -182,7 +182,7 @@ async function pushEnvironmentVariables() {
 
   try {
     const settings = getSettings();
-    const envFile = path.join(process.cwd(), settings.envFile);
+    const envFile = path.join(process.cwd(), settings.envFile ?? ".env");
 
     if (!fs.existsSync(envFile)) {
       spinner.stop("No environment file found");