ci(functions-compiler): add a manual npm publish workflow

[yurynix]

Note

Description

Adds a manual npm publish workflow for @base44/functions-compiler so the compiler package can be released independently of the CLI's own release train. The workflow bumps the version, syncs the COMPILER_VERSION literal, builds lib/, publishes to npm via trusted publishing (OIDC — no NPM_TOKEN in the repo), and pushes a functions-compiler-v<version> tag plus release commit. It also fixes the version drift already on main (package.json at 0.1.1, the literal still at 0.1.0) and adds a sync-version.ts script so a release cannot forget the second file again.

Related Issue

None

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Other (please describe): CI / release automation — no CLI runtime code changes

Changes Made

• New .github/workflows/functions-compiler-publish.yml (workflow_dispatch with version, npm_tag, dry_run inputs): installs with --frozen-lockfile, bumps with npm version --no-workspaces (so the CLI is not bumped alongside), syncs the version literal, runs bun run build in packages/functions-compiler, publishes, then commits and pushes a functions-compiler-v<version> tag. All actions are SHA-pinned and the job runs under a GitHub App token.
• Publishes via npm trusted publishing (OIDC, id-token: write) instead of an NPM_TOKEN; the tag/commit step is skipped on dry_run. Compiler releases use functions-compiler-v* to stay clear of the CLI's v* series.
• Adds packages/functions-compiler/scripts/sync-version.ts: rewrites the COMPILER_VERSION literal in src/version.ts from package.json, and throws (rather than silently no-opping) if the literal can't be found.
• Fixes the existing drift by bumping src/version.ts to 0.1.1 — test/version.test.ts asserts the literal matches package.json, so main is currently red on it.
• Adds repository (with directory: packages/functions-compiler) to the package manifest, which trusted publishing requires to match the publishing repo and which npm uses for provenance linking.
• Registers the workflow in PUBLISH_WORKFLOWS in .github/scripts/check_wix_proxy_steps.py, exempting it from the mandatory Wix gateway proxy — the gateway cannot carry npm publish, matching the existing exemptions for manual-publish.yml and preview-publish.yml. The workflow header documents the tradeoff (--frozen-lockfile plus bunfig.toml's minimumReleaseAge).
• Documents the release process in packages/functions-compiler/README.md, including that the trusted publisher is keyed on the workflow filename, and that the tarball proof (scripts/verify-package.ts) still runs in functions-compiler.yml on every push to main — so publish from a commit that went green there.

Testing

• I have tested these changes locally
• I have added/updated tests as needed
• All tests pass (npm test)

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (if applicable)
• My changes generate no new warnings
• I have updated docs/ (AGENTS.md) if I made architectural changes

Additional Notes

• No new tests: the existing test/version.test.ts already covers the literal/package.json invariant that sync-version.ts maintains, and the bump in src/version.ts is what makes it pass again. A workflow_dispatch publish workflow cannot be exercised from a PR branch — the first run should use dry_run: true to validate the bump/build/pack path.
• Prerequisite before the first real run: a trusted publisher for @base44/functions-compiler must be registered on npmjs.com against this repo and functions-compiler-publish.yml. The entries for manual-publish.yml / preview-publish.yml do not cover it, and publishing will fail without it.
• Unlike the CLI, this package is not bundled — esbuild, @deno/loader and zod stay as real runtime dependencies, so nothing is stripped from package.json before publish.
• docs/ was not updated because this changes release plumbing, not architecture; the package-local README is the documented home for its release process.

---

_{🤖 Generated by Claude | 2026-09-17 16:15 UTC | a8420c7}

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/cli@0.1.15-pr.631.a8420c7

Prefer not to change any import paths? Install using npm alias so your code still imports base44:

npm i "base44@npm:@base44-preview/cli@0.1.15-pr.631.a8420c7"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "base44": "npm:@base44-preview/cli@0.1.15-pr.631.a8420c7"
  }
}

• 📦 Preview Package: @base44-preview/cli@0.1.15-pr.631.a8420c7
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}