ci(sdk): release commit survives codegen drift and keeps the lockfile in sync

The first release from the workflow published every package but could not
push the version commit: the setup action's codegen had rewritten a tracked
file from a live source, and git refused to rebase with that change
unstaged. The rebase now autostashes. The release commit also refreshes
bun.lock, which records the workspace versions, so main's frozen install
keeps working after a bump. The publish script formats with bunx instead of
npx, which stops npm's package-manager warnings on every package.

Author: lindesvard

.github/workflows/sdks.yml

@@ -150,9 +150,12 @@ jobs:
           set -euo pipefail
           dir="$(bun -e 'const fs = require("fs"); for (const d of fs.readdirSync("packages/sdks")) { const p = `packages/sdks/${d}/package.json`; if (fs.existsSync(p) && require(`./${p}`).name === process.argv[1]) console.log(d) }' "$PACKAGE")"
           version="$(jq -r '.version | sub("-local$"; "")' "packages/sdks/$dir/package.json")"
+          # The lockfile records the workspace versions, so main's frozen
+          # install breaks without this.
+          bun install
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add packages/sdks apps/public/public/op1.js apps/public/public/op1-replay.js
+          git add bun.lock packages/sdks apps/public/public/op1.js apps/public/public/op1-replay.js
           git commit -m "chore(sdk): release $PACKAGE $version" \
             -m "Released from the SDKs workflow ($BUMP bump). Dependent SDKs were released with it; see the package versions in this commit."
           git format-patch -1 --stdout > /tmp/sdk-release.patch
@@ -161,11 +164,13 @@ jobs:
 
       # The packages are on npm by now, so this commit must land whatever
       # happened on main meanwhile: rebase onto the current tip, never force.
+      # --autostash: the setup action's codegen rewrites a tracked file from a
+      # live source, and that stray change must not block the rebase.
       - name: Push the release commit to main
         run: |
           set -euo pipefail
           git fetch origin main
-          if ! git rebase origin/main; then
+          if ! git rebase --autostash origin/main; then
             echo "::error::main moved during the release and the version commit conflicts with it. The packages are published; apply the sdk-release-commit artifact to main by hand."
             exit 1
           fi

tooling/publish/publish.ts

@@ -47,7 +47,7 @@ const workspacePath = (relativePath: string) =>
 
 const savePackageJson = (absPath: string, data: PackageJson) => {
   fs.writeFileSync(absPath, JSON.stringify(data, null, 2), 'utf-8');
-  execSync(`npx biome format ${absPath} --fix`);
+  execSync(`bunx biome format ${absPath} --fix`);
 };
 
 const exit = (message: string, error?: unknown) => {